CVE-2026-44575

A flaw was found in Next.js. App Router applications that use middleware or proxy-based authorization checks are vulnerable to unauthorized access. A remote attacker can exploit this by crafting specific .rsc and segment-prefetch URLs, which bypass the intended middleware rules. This allows access to protected content without proper authorization.

This is an Important flaw in Next.js App Router applications that utilize middleware or proxy-based authorization. A remote attacker can bypass these security checks by crafting specific URLs, leading to unauthorized access to protected content. This is due to transport-specific route variants used for segment prefetching not being consistently matched by middleware rules.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.