CVE-2026-44575

score

<0.1

cvss

7.5

epss

0.8%

published

2026-05-13

kev added

—

first seen

2026-10-21

Next.js 15.2.0 to < 15.5.16 and 16.2.5 contains an authorization bypass caused by transport-specific route variants in App Router middleware, letting attackers access protected content without authorization checks, exploit requires specific middleware or proxy-based authorization.