CVE-2026-44573

score

<0.1

cvss

7.5

epss

0.8%

published

2026-05-13

kev added

—

first seen

2026-10-21

Next.js 12.2.0 to < 15.5.16 and 16.2.5 contains a broken access control caused by middleware not running on locale-less data routes, letting attackers access protected page data without authorization, exploit requires Pages Router with i18n and middleware/proxy-based authorization.