Middleware-Bypass — PoC Archivehttps://poc.intelseclab.com/tags/middleware-bypass/Latest proof-of-concept entries.Hugoen-usSun, 17 May 2026 00:00:00 +0000Next.js i18n Middleware Bypass (CVE-2026-44573)https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-i18n-middleware-bypass/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-i18n-middleware-bypass/High severity (CVSS 7.5) — web · CVE-2026-44573. Status: Weaponized. Affects: Next.js Pages Router with i18n configuration. Tags: middleware-bypass, i18n, _next/data, Pages-Router, authorization-bypass, information-disclosure, Next.js, unauthenticated.webHighmiddleware-bypassi18n_next/dataPages-Routerauthorization-bypassinformation-disclosureNext.jsunauthenticatedNext.js Dynamic Route Injection Auth Bypass (CVE-2026-44574)https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-dynamic-route-injection-auth-bypass/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-dynamic-route-injection-auth-bypass/High severity (CVSS 8.1) — web · CVE-2026-44574. Status: Weaponized. Affects: Next.js App Router with dynamic route segments and middleware-based access control. Tags: auth-bypass, dynamic-route, nxtP-injection, middleware-bypass, param-smuggling, Next.js, App-Router, unauthenticated.webHighauth-bypassdynamic-routenxtP-injectionmiddleware-bypassparam-smugglingNext.jsApp-RouterunauthenticatedNext.js App Router Segment-Prefetch Middleware Bypass (CVE-2026-44575)https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-segment-prefetch-middleware-bypass/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-segment-prefetch-middleware-bypass/High severity (CVSS 7.5) — web · CVE-2026-44575. Status: Weaponized. Affects: Next.js App Router applications that rely on middleware.ts matchers to protect routes. Tags: authorization-bypass, middleware-bypass, App-Router, segment-prefetch, RSC, Next.js, unauthenticated.webHighauthorization-bypassmiddleware-bypassApp-Routersegment-prefetchRSCNext.jsunauthenticatedNext.js Corrupt Middleware Auth Bypass (CVE-2025-29927)https://poc.intelseclab.com/pocs/web/2026-05-15_nextjs-middleware-bypass-cve-2025-29927/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-15_nextjs-middleware-bypass-cve-2025-29927/Critical severity (CVSS 9.1) — web · CVE-2025-29927. Status: Weaponized. Affects: Next.js (Vercel). Tags: auth-bypass, middleware-bypass, Next.js, unauthenticated, header-injection.webCriticalauth-bypassmiddleware-bypassNext.jsunauthenticatedheader-injection