CVE-2026-44573 in Next.js 16.1.1

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

Severity

High 7.5

Exploitation

1% chance of exploit
in the next 30 days

Fix

Update to 16.2.5

Where

App / API

How it matched

Exact version match

Also known as

GHSA-36qx-fr4f-26g5

First seen

2026-11-05 01:13:58 UTC

Source

https://osv.dev/vulnerability/GHSA-36qx-fr4f-26g5