GitHub Advisoryadvisory · npm

GHSA-26hh-7cqf-hhc6 Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

HIGH Published 2026-05-11 Modified 2026-05-14 Official page ↗
Aliases
CVE-2026-45109
Ecosystem
npm
Packages
next
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-288
Reviewed
2026-05-11

Affected packages

• npm next: >= 15.2.0, < 15.5.18 → fixed in 15.5.18 • npm next: >= 16.0.0, < 16.2.6 → fixed in 16.2.6

Description

Impact It was found that the fix addressing CVE-2026-44575 did not apply to `middleware.ts` with Turbopack. Refer to CVE-2026-44575 for further details. References • CVE CVE-2026-44575

Related

Alias · CVE (1)

  • CVE-2026-45109 Next.js is a React framework for building full-stack web applications. vulnerability

Weakness · CWE (1)

  • CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness

References