Security readout for executives and security teams
Plain-English summary
Affected Next.js applications may expose protected server-rendered page data without requiring login. The issue matters when the Pages Router, internationalization, and middleware or proxy authorization are used together. An unauthenticated internet user could obtain confidential information, but the supplied sources do not indicate data modification or service disruption.
Executive priority
Prioritize remediation for internet-facing applications handling sensitive protected data. Patch promptly after identifying the affected configuration, then validate authorization at the page-data layer. Applications lacking the Pages Router, i18n, or middleware/proxy authorization combination are not shown by the supplied evidence to be affected.
Technical view
In affected configurations, locale-less Next.js page-data requests bypass middleware or proxy authorization because that logic does not run for the unprefixed data route. This can disclose SSR JSON for protected pages. CVSS 3.1 is 7.5: network-accessible, low complexity, no privileges or user interaction, with high confidentiality impact only.
Likely exposure
Exposure is limited to Next.js versions 12.2.0 through 15.5.15 and 16.0.0 through 16.2.4 where Pages Router, i18n, and middleware or proxy authorization protect page data. Risk is highest for public applications whose protected SSR responses contain personal, financial, customer, or operational information.
Exploitation context
The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or a public exploit. Nevertheless, the CVSS characteristics indicate that an unauthenticated remote attacker could exploit an exposed affected configuration with low complexity. Treat exploit status as unconfirmed, not proof of safety.
Researcher notes
The underlying weakness is an authorization-enforcement inconsistency between localized page routing and locale-less data routing, mapped to CWE-551 and CWE-863. Assessment should distinguish page HTML protection from SSR JSON protection. The supplied evidence does not quantify real-world exploitation, identify additional affected configurations, or name a workaround besides upgrading.
Mitigation direction
- Upgrade Next.js to fixed version 15.5.16 or 16.2.5, as appropriate.
- Use a later vendor-supported release only after confirming it includes the fix.
- Prioritize applications exposing sensitive server-rendered data behind middleware or proxy authorization.
- Review the Next.js vendor advisory for any deployment-specific guidance.
- Avoid treating client-side access controls as substitutes for server-side authorization.
Validation and detection
- Inventory deployed Next.js versions and identify applications using the Pages Router.
- Confirm whether i18n and middleware or proxy authorization are enabled together.
- Identify protected SSR pages whose JSON responses contain sensitive information.
- Verify production deployments run Next.js 15.5.16, 16.2.5, or a confirmed fixed release.
- After upgrading, confirm unauthenticated page-data requests remain subject to authorization.
- Review access logs for unexpected requests to unprefixed Next.js page-data routes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-551: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-44573 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6GitHub_MCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-05-13T18:01:50.343Z: Reported to Red Hat.
- 2026-05-13T16:48:16.218Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5CVE reference, GitHub_M · x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-44573CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2477199CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44573.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:40974CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37272CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34608CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54435CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Incorrect Behavior Order: Authorization Before Parsing and Canonicalization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.