CVE-2026-44574 in Next.js 16.1.1

Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

Severity

High 8.1

Exploitation

1% chance of exploit
in the next 30 days

Fix

Update to 16.2.5

Where

App / API

How it matched

Exact version match

Also known as

GHSA-492v-c6pp-mqqv

First seen

2026-11-05 01:13:58 UTC

Source

https://osv.dev/vulnerability/GHSA-492v-c6pp-mqqv