CVE-2026-45109
Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.
- Record
CVE-2026-45109- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-288, CWE-358
- Updated
- 2026-11-04
EUVDEUVD-2026-30085
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.
- Record
EUVD-2026-30085- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-26hh-7cqf-hhc6
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
Impact
It was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. Refer to CVE-2026-44575 for further details.
References
- Record
GHSA-26hh-7cqf-hhc6- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-288, CWE-358
- Updated
- 2026-11-04
NVD
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.
- Record
CVE-2026-45109- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-288, CWE-358
- Updated
- 2026-11-04
OSV
Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.
- Record
CVE-2026-45109- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-288
- Updated
- 2026-11-05
OSVGHSA-26hh-7cqf-hhc6
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
Impact
It was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. Refer to CVE-2026-44575 for further details.
References
- Record
GHSA-26hh-7cqf-hhc6- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-288
- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-45109 No score
CVE-2026-45109 in next - Patched by Root
Root has patched CVE-2026-45109 in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-45109- Updated
- 2026-11-02
Affected products
- vercel next.js
- red hat enterprise linux 10
- red hat enterprise linux 7
- red hat enterprise linux 8
- red hat enterprise linux 9
- red hat enterprise linux ai (rhel ai) 3
- red hat trusted artifact signer 1.3
- red hat trusted artifact signer 1.4
- red hat streams for apache kafka 2.9.4
- red hat streams for apache kafka 3
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nextnpm |
15.2.0 up to 15.5.18 | 15.5.18 |
nextnpm |
16.0.0 up to 16.2.6 | 16.2.6 |
nextRoot:npm |
before 16.1.6-aikido.4 | 16.1.6-aikido.416.2.5-aikido.116.1.7-aikido.116.1.6-aikido.515.5.15-aikido.215.5.10-aikido.616.1.7-aikido.215.5.15-aikido.316.1.6-aikido.615.5.15-aikido.416.1.6-aikido.716.1.7-aikido.316.2.5-aikido.316.2.5-aikido.216.1.6-aikido.815.5.18-aikido.115.5.18-aikido.215.5.18-aikido.3 |
@rootio/nextRoot:npm |
before 16.1.6-root.io.2 | 16.1.6-root.io.215.5.15-root.io.116.1.6-root.io.316.2.5-root.io.116.1.6-root.io.416.1.7-root.io.116.1.6-root.io.515.5.15-root.io.215.5.10-root.io.616.1.7-root.io.215.5.15-root.io.316.1.6-root.io.615.5.15-root.io.416.1.6-root.io.716.1.7-root.io.316.2.5-root.io.316.2.5-root.io.216.1.6-root.io.815.5.18-root.io.115.5.18-root.io.215.5.18-root.io.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| references | EUVD, NVD, OSV | |
| references | CVE List | |
| facts, references | GitHub Advisories | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-45109 is a high vulnerability (CVSS 7.5) in Vercel Next.js, published May 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.85%, the 58th percentile. Fixed in next 15.5.18.
References
github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6
vercel.com/changelog/next-js-may-2026-security-release
access.redhat.com/security/cve/CVE-2026-45109
Show 10 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2477190
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45109.json
nvd.nist.gov/vuln/detail/CVE-2026-45109