Next.js version 12.2.0 through 15.5.15 and 16.2.4 in Pages Router configurations with i18n enabled allows an attacker to read server‑side rendered JSON for protected pages without authentication, because middleware does not execute for unprefixed /_next/data requests. The flaw yields confidentiality compromise of page content and related data, potentially revealing sensitive application state. The weakness corresponds to missing authorization enforcement (CWE-863) and special‑case logic errors (CWE-551).

The vulnerability affects Vercel's Next.js framework, specifically versions 12.2.0 to 15.5.15 inclusive and up to 16.2.4. It requires a Pages Router application using i18n and middleware or proxy‑based authorization. Upgrading to 15.5.16 or 16.2.5 removes the issue. If an organization uses a lower or higher unpatched version, they remain at risk.

The CVSS score of 7.5 indicates a high severity. The EPSS score is 0.00052 (less than 1 %), suggesting a very low probability of exploitation in the wild, but the flaw can still be readily exploited. Because it is not listed in CISA KEV, active exploitation may not yet be widespread, yet it offers a straightforward defacement or data extraction attack path. The most likely attack vector is a direct request to /_next/data/<buildId>/<page>.json, bypassing all middleware checks.