AIKIDO-2026-10757
next is vulnerable to Authentication Bypass
75
High Risk
This Affects:
nextTL;DR
Pages Router deployments with i18n can expose locale-less data routes that skip middleware checks. An attacker can request internal JSON data endpoints for protected pages without the expected authorization gate. This enables alternate-path access to protected page data. The fix updates matcher behavior so i18n data routes receive equivalent middleware matching.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
next is vulnerable to Authentication Bypass in versions 12.2.0 - 15.5.15 and 16.0.0 - 16.2.4.
How to fix this
Upgrade the next library to the patch version.
Links
GitHub Release
Other
access.redhat.com/errata/RHSA-2026:34608access.redhat.com/errata/RHSA-2026:37272access.redhat.com/errata/RHSA-2026:40974access.redhat.com/errata/RHSA-2026:54435access.redhat.com/security/cve/CVE-2026-44573bugzilla.redhat.com/show_bug.cgi?id=2477199security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44573.json
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.