Attack Chain

1. The attacker identifies a Next.js application using the Pages Router with i18n configured.
2. The attacker identifies a protected page that requires authentication or authorization based on middleware.
3. The attacker crafts a request to /_next/data/<buildId>/<page>.json for the protected page, omitting any locale prefix. The <buildId> would be a valid build ID for the application, typically obtained from the HTML source of a page. The <page> is the path to the page.
4. The Next.js server processes the request for the /_next/data route, but the middleware intended to protect the page is not triggered.
5. The server fetches and returns the SSR JSON data for the protected page.
6. The attacker receives the SSR JSON data, gaining access to the content of the protected page without proper authorization.
7. The attacker analyzes the data, potentially finding sensitive information or API keys.

Impact

Successful exploitation of this vulnerability allows unauthorized access to sensitive data within Next.js applications. The impact depends on the nature of the data exposed on the protected pages. This could include personal user information, internal application data, or even API keys. This could lead to data breaches, account compromise, or further attacks against the application or its users.

Recommendation

• Upgrade to Next.js version 15.5.16 or 16.2.5 or later to patch CVE-2026-44573.
• If immediate upgrade is not possible, enforce authorization checks within the getServerSideProps or getStaticProps functions of affected pages as a workaround.
• Deploy the Sigma rule “Detect Next.js i18n Auth Bypass Attempt” to identify potential exploitation attempts targeting the /_next/data endpoint.
• Monitor web server logs for requests to the /_next/data endpoint without a locale prefix, as this is indicative of potential exploitation.