Next.js Framework 15.4.x < 15.5.16 / 16.x < 16.2.5 Authorization Bypass

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(314909);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/18");

  script_cve_id("CVE-2026-44574");
  script_xref(name:"IAVA", value:"2026-A-0443");

  script_name(english:"Next.js Framework 15.4.x < 15.5.16 / 16.x < 16.2.5 Authorization Bypass");

  script_set_attribute(attribute:"synopsis", value:
"The Next.js Framework on the remote host is affected by an authorization bypass vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Next.js Framework on the remote host is affected by an authorization bypass vulnerability:

  - Applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass.
    Specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible
    path unchanged, which can allow protected content to be rendered without passing the expected middleware check.
    (CVE-2026-44574)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fbae624b");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Next.js Framework version 15.5.16 or 16.2.5 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-44574");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vercel:next.js");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

get_kb_item_or_exit('Host/nodejs/modules/enumerated');

vcf::add_separator('-');
vcf::add_conversions({'canary':-25});

var app_info = vcf_extras::nodejs_modules::get_app_info(app:'next');

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, 'next');

var constraints = [
  {'min_version':'15.4.0', 'fixed_version':'15.5.16'},
  {'min_version':'16.0.0', 'fixed_version':'16.2.5'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);