next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n

🗓️ 12 Aug 2026 19:35:14Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 6 Views

Next.js Pages Router i18n middleware bypass allows unauthorized access to SSR JSON data.

Reporter	Title	Published	Views	Family All 32
GithubExploit	Exploit for CVE-2026-23870	7 May 202623:00	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple packages which are vulnerable to multiple CVEs.	8 Jul 202610:39	–	ibm
ATTACKERKB	CVE-2026-44573	13 May 202616:48	–	attackerkb
BDU FSTEC	The vulnerability of the Next.js web application development software platform, related to deficiencies in authentication procedures, allows attackers to bypass existing security mechanisms and gain unauthorized access to protected information.	18 May 202600:00	–	bdu_fstec
Chainguard	CVE-2026-44573 vulnerabilities	13 May 202601:17	–	cgr
Circl	CVE-2026-44573	8 May 202612:09	–	circl
CNNVD	Next.js 安全漏洞	13 May 202600:00	–	cnnvd
CVE	CVE-2026-44573	13 May 202616:48	–	cve
Cvelist	CVE-2026-44573 Next.js: Middleware / Proxy bypass in Pages Router applications using i18n	13 May 202616:48	–	cvelist
Github Security Blog	Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n	11 May 202615:53	–	github

Vulners

Node

AND

redhat amq_streamsRange<3.2el9

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-44573
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-44573
cve	www.cve.org/CVERecord

20 Aug 2026 16:09Current

7.2High risk

Vulners AI Score7.2

CVSS 3.17.5

EPSS0.0062

SSVC

Next.js Pages Router i18n Middleware Bypass Information Disclosure