The flaw is caused by the way Next.js App Router handles transport‑specific segment‑prefetch URLs. A specially crafted ".rsc" or segment‑prefetch URL can resolve to the same page as a normal request while never matching the intended middleware rule, thereby preventing the middleware or proxy from executing its authorization check. An attacker who can supply such URLs can reach protected content without authenticating, effectively bypassing application‑level access controls.

The vulnerability affects Next.js applications built with the App Router that employ middleware or proxy checks for authorization. It is present in Next.js releases from version 15.2.0 up to, but not including, 15.5.16, and in the 16.2.5 series only to the point before the fix. The issue is specific to the "vercel:next.js" framework.

The flaw carries a CVSS score of 7.5, indicating a high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV. The exploit path is straightforward: an attacker simply supplies a crafted segment‑prefetch URL from a client or browser. Successful exploitation does not require authentication or privileged access. Given the simplicity of constructing such URLs, the risk to exposed applications that have not patched is significant.