AIKIDO-2026-10761
next is vulnerable to Authentication Bypass
75
High Risk
This Affects:
nextTL;DR
App Router transport-specific segment-prefetch route variants can bypass middleware or proxy authorization checks. Crafted request paths can reach protected content without hitting expected matcher logic. This creates an alternate access path that weakens route-level protection assumptions. The fix includes transport variants in matcher generation so authorization checks apply consistently.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
next is vulnerable to Authentication Bypass in versions 15.2.0 - 15.5.15 and 16.0.0 - 16.2.4.
How to fix this
Upgrade the next library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant