Next.js version 12.2.0 through 15.5.15 and 16.2.4 in Pages Router configurations with i18n enabled allows an attacker to read server‑side rendered JSON for protected pages without authentication, because middleware does not execute for unprefixed /_next/data requests. The flaw yields confidentiality compromise of page content and related data, potentially revealing sensitive application state. The weakness corresponds to missing authorization enforcement (CWE-863).

The vulnerability affects Vercel's Next.js framework, specifically versions 12.2.0 to 15.5.15 inclusive and up to 16.2.4. It requires a Pages Router application using i18n and middleware or proxy‑based authorization. Upgrading to 15.5.16 or 16.2.5 removes the issue. If an organization uses a lower or higher unpatched version, they remain at risk.

The CVSS score of 7.5 indicates a high severity. No EPSS data is available, but the flaw is exploitable through direct URL construction without authentication, implying a low barrier to execution. Because it remains unpublished in the CISA KEV catalog, active exploitation may not yet be widespread, yet the vulnerability offers a straightforward defacement or data extraction attack path. The most likely attack vector is a direct request to /_next/data/<buildId>/<page>.json, bypassing all middleware checks.