Next.js Authorization Bypass Vulnerability in Middleware for Dynamic Routes

A vulnerability allowing authorization bypass has been identified in Next.js versions 15.4.0 prior to 15.5.16 and 16.0.0 prior to 16.2.5. This issue arises in applications that use middleware to protect dynamic routes. In affected deployments, specially crafted query parameters can manipulate the dynamic route value perceived by the page, while keeping the visible path unchanged. This manipulation can enable protected content to be displayed without undergoing the necessary middleware verification.

Impact

Exploitation of this vulnerability can lead to unauthorized access to protected content by bypassing middleware checks on dynamic routes.

Remediation

Users can upgrade to Next.js versions 15.5.16 or 16.2.5 to address this vulnerability. If an immediate upgrade is not possible, it is recommended to enforce authorization within route or page logic, rather than relying solely on middleware path matching.