CVE-2026-45109: Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-13 · updated 2026-10-26
Weakness: CWE-288

Description

Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.

Affected products

Next.js: from 15.2.0 before 15.5.18; from 16.0.0 before 16.2.6 — fixed in 15.5.18, 16.2.6

How to fix

Upgrade to a fixed version: Next.js 15.5.18, 16.2.6. Check the vendor advisory for mitigations.

References

https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6
https://access.redhat.com/errata/RHSA-2026:34608
https://access.redhat.com/errata/RHSA-2026:37272
https://access.redhat.com/errata/RHSA-2026:40974
https://access.redhat.com/errata/RHSA-2026:54435
https://access.redhat.com/security/cve/CVE-2026-45109
https://bugzilla.redhat.com/show_bug.cgi?id=2477190
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45109.json

Get alerted when CVE-2026-45109 or the next vulnerability affects your stack