Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-05-13T16:56:06 Next.js: Next.js: Authorization bypass via crafted query parameters 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CWE-551

Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check. This vulnerability is fixed in 15.5.16 and 16.2.5.

A flaw was found in Next.js. This vulnerability allows an attacker to bypass security checks in web applications that use Next.js middleware to protect specific web pages. By sending specially crafted web addresses, an attacker can access protected content without proper authorization. This could lead to unauthorized viewing of sensitive information or access to restricted features.

This is an Important authorization bypass flaw in Next.js applications, which are utilized in Red Hat AMQ, Red Hat Trusted Artifact Signer, and Red Hat Enterprise Linux AI. The vulnerability arises when applications use Next.js middleware to protect dynamic routes, allowing attackers to access restricted content by manipulating query parameters. This bypass occurs because specially crafted parameters can alter the route value seen by the page while the visible path remains unchanged, circumventing intended security controls. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Streams for Apache Kafka 2.9.4 2026-07-02T00:00:00Z RHSA-2026:34608 next Red Hat Trusted Artifact Signer 1.3 2026-07-16T00:00:00Z RHSA-2026:40974 rhtas/rekor-search-ui-rhel9:1783958622 Red Hat Trusted Artifact Signer 1.4 2026-07-09T00:00:00Z RHSA-2026:37272 rhtas/rekor-search-ui-rhel9:1783327185 Red Hat Enterprise Linux 10 Not affected firefox Red Hat Enterprise Linux 10 Not affected thunderbird Red Hat Enterprise Linux 7 Not affected firefox Red Hat Enterprise Linux 8 Not affected firefox Red Hat Enterprise Linux 8 Not affected thunderbird Red Hat Enterprise Linux 9 Not affected firefox Red Hat Enterprise Linux 9 Not affected thunderbird Red Hat Enterprise Linux AI (RHEL AI) 3 Will not fix rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Will not fix rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Will not fix rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Will not fix rhelai3/disk-image-cuda-rhel9 streams for Apache Kafka 3 Affected next https://www.cve.org/CVERecord?id=CVE-2026-44574 https://nvd.nist.gov/vuln/detail/CVE-2026-44574 https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv