This emergency release introduces a new rule to detect Next.js App Router middleware and proxy bypass attempts via segment-prefetch routes (CVE-2026-44575).
Key Findings
CVE-2026-44575: Next.js Middleware / Proxy Bypass in App Router Applications via Segment-Prefetch Routes
Successful exploitation allows unauthenticated attackers to bypass middleware or proxy-based authorization checks in affected Next.js App Router applications. This leads to unauthorized access to protected content, potential exposure of sensitive application data, and compromise of application security boundaries.
We strongly recommend upgrading to Next.js 15.5.16 or 16.2.5 (or later) immediately to address the underlying vulnerability. If you cannot upgrade immediately, enforce authorization in the underlying route or page logic instead of relying solely on middleware.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | 1de95bf6d6374e1099854278e77e4a53 | N/A | Next.js – Middleware Bypass via Invalid RSC Header – CVE:CVE-2026-44575 | N/A | Disabled | This is a new detection. |
Source: Cloudflare
Latest Posts
- AWS Billing and Cost Management now provides billing context for your account through a new API
- MC1478975: Microsoft 365 Copilot Adds Support for Agent2Agent-Enabled Microsoft Agent 365 Agents in Declarative Agents
- MC1478969: Microsoft Edge for Android Retires Citrix Mobile VPN Integration Support
- MC1478957: Microsoft 365 Profile Card Adds Dotted-Line Managers to the Organization Panel
