CVE-2026-32541: Next.js middleware bypass — analysis and fix

The vulnerability

CVE-2026-32541, published in late May 2026, affects Next.js applications using middleware for authentication and authorization. An attacker could bypass middleware by manipulating request headers, accessing protected pages without authentication.

Affected versions: Next.js 14.0 to 15.2.3

Severity: Critical (CVSS 9.1)

Fix: Next.js 15.2.4+

How it works

Next.js middleware runs at the edge, before page rendering. Many SaaS vendors use it for authentication checks:

```typescript

// middleware.ts

export function middleware(request: NextRequest) {

const token = request.cookies.get('session')

if (!token) {

return NextResponse.redirect(new URL('/login', request.url))

}

}

`

The vulnerability exploited an undocumented behavior: by sending an x-middleware-prefetch header with a specific value, the middleware was completely skipped. The request reached the protected page directly.

Impact for HR SaaS

If your Next.js application uses middleware as the only authentication layer (which is common), an attacker could:

Several of our clients were affected. We alerted them within 24 hours of the CVE publication.

How to check if you're affected

Fix

Short term

Update Next.js immediately:

```bash

npm install next@latest

`

Long term

Never rely on a single security layer. Middleware is convenient for redirects, but authorization should also be verified:

Defense in depth means exactly that: even if one layer is compromised, the others hold.

The role of auditing

This CVE illustrates why regular auditing is necessary. During our Next.js audits, we systematically check that authentication isn't solely carried by middleware. We test known bypasses and verify defense in depth is in place.