CVE-2026-45109 PUBLISHED

Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Assigner: GitHub_M
Reserved: 08.05.2026 Published: 13.05.2026 Updated: 13.05.2026

Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 7.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	vercel
Product	next.js
Versions	Version >= 15.2.0, < 15.5.17 is affected Version >= 16.0.0, < 16.2.6 is affected

References

https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6

Problem Types

CWE-288: Authentication Bypass Using an Alternate Path or Channel CWE