{"id":"CVE-2026-44575","aliases":["CLSA-2026-1786995617","CLSA-2026-1792195750","CLSA-2026-1792196728","CLSA-2026-1792206304","CLSA-2026-1792256964","CLSA-2026-1792272246","CLSA-2026-1792293016","CLSA-2026-1792304741","CLSA-2026-1792326304","CLSA-2026-1792338235","CLSA-2026-1792346470","CLSA-2026-1792358599","CLSA-2026-1792364004","CLSA-2026-1792367391","EUVD-2026-30059","GHSA-267c-6grr-h53f","ROOT-APP-NPM-CVE-2026-44575"],"status":"published","title":"Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes","description":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01594,"percentile":0.7588,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-288","CWE-551"],"published":"2026-05-11T15:54:24Z","modified":"2026-10-28T02:30:55Z","fixes":[{"ecosystem":"npm","package":"next","fixed_in":["15.5.16","16.2.5"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"next","fixed_in":["15.5.10-aikido.4","15.5.10-aikido.5","16.1.6-aikido.4","16.1.7-aikido.1","16.1.6-aikido.5","15.5.15-aikido.2","15.5.10-aikido.6","16.1.7-aikido.2","15.5.15-aikido.3","16.1.6-aikido.6","15.5.15-aikido.4","16.1.6-aikido.7","16.1.7-aikido.3","15.5.10-aikido.3","16.1.6-aikido.8","16.2.5-aikido.1","16.2.5-aikido.3","16.2.5-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/next","fixed_in":["16.1.6-root.io.1","16.1.6-root.io.2","15.5.15-root.io.1","16.1.6-root.io.3","15.5.10-root.io.4","15.5.10-root.io.5","16.1.6-root.io.4","16.1.7-root.io.1","16.1.6-root.io.5","15.5.15-root.io.2","15.5.10-root.io.6","16.1.7-root.io.2","15.5.15-root.io.3","16.1.6-root.io.6","15.5.15-root.io.4","16.1.6-root.io.7","16.1.7-root.io.3","15.5.10-root.io.3","16.1.6-root.io.8","16.2.5-root.io.1","16.2.5-root.io.3","16.2.5-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.0"},{"fixed":"15.5.16"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"fixed":"16.2.5"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-next-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.7"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.7"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.7"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"next-rspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.7"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.7"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.7"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.7"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.7"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/third-parties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.7"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.7"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/codemod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.7"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/mdx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.7"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.7"}]}],"versions":["16.0.6","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6"],"bundled":9},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.2.0"},{"fixed":"15.5.16"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"16.2.5"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.5.10-aikido.4"},{"fixed":"15.5.10-aikido.5"},{"fixed":"16.1.6-aikido.4"},{"fixed":"16.1.7-aikido.1"},{"fixed":"16.1.6-aikido.5"},{"fixed":"15.5.15-aikido.2"},{"fixed":"15.5.10-aikido.6"},{"fixed":"16.1.7-aikido.2"},{"fixed":"15.5.15-aikido.3"},{"fixed":"16.1.6-aikido.6"},{"fixed":"15.5.15-aikido.4"},{"fixed":"16.1.6-aikido.7"},{"fixed":"16.1.7-aikido.3"},{"fixed":"15.5.10-aikido.3"},{"fixed":"16.1.6-aikido.8"},{"fixed":"16.2.5-aikido.1"},{"fixed":"16.2.5-aikido.3"},{"fixed":"16.2.5-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.6-root.io.1"},{"fixed":"16.1.6-root.io.2"},{"fixed":"15.5.15-root.io.1"},{"fixed":"16.1.6-root.io.3"},{"fixed":"15.5.10-root.io.4"},{"fixed":"15.5.10-root.io.5"},{"fixed":"16.1.6-root.io.4"},{"fixed":"16.1.7-root.io.1"},{"fixed":"16.1.6-root.io.5"},{"fixed":"15.5.15-root.io.2"},{"fixed":"15.5.10-root.io.6"},{"fixed":"16.1.7-root.io.2"},{"fixed":"15.5.15-root.io.3"},{"fixed":"16.1.6-root.io.6"},{"fixed":"15.5.15-root.io.4"},{"fixed":"16.1.6-root.io.7"},{"fixed":"16.1.7-root.io.3"},{"fixed":"15.5.10-root.io.3"},{"fixed":"16.1.6-root.io.8"},{"fixed":"16.2.5-root.io.1"},{"fixed":"16.2.5-root.io.3"},{"fixed":"16.2.5-root.io.2"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat trusted artifact signer 1.3"},{"vendor":"red hat","product":"red hat trusted artifact signer 1.4"},{"vendor":"red hat","product":"streams for apache kafka 2.9.4"},{"vendor":"red hat","product":"streams for apache kafka 3"},{"vendor":"vercel","product":"next.js"}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44575","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477188","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44575.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40974","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37272","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34608","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54435","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://github.com/vercel/next.js/releases/tag/v15.5.16","tags":["web"]},{"url":"https://github.com/vercel/next.js/releases/tag/v16.2.5","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44575","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-267c-6grr-h53f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44575.json","tags":["advisory"]},{"url":"https://github.com/vercel/next.js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-44575","title":"Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes","description":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.","status":"published","published":"2026-05-13T16:54:39.455Z","modified":"2026-08-13T12:04:21.797Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-288","CWE-551"],"updated_at":"2026-11-02T13:43:00.288193Z"}],"euvd":[{"id":"EUVD-2026-30059","description":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.","status":"published","published":"2026-05-13T16:54:39Z","modified":"2026-08-13T12:04:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:57.213133Z"}],"ghsa":[{"id":"GHSA-267c-6grr-h53f","title":"Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes","description":"### Impact\n\nApp Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted `.rsc` and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check.\n\n### Fix\n\nWe now include App Router transport variants when generating middleware matchers, so middleware protections are applied consistently to those requests as well as to the normal page URL.\n\n### Workarounds\n\nIf you cannot upgrade immediately, enforce authorization in the underlying route or page logic instead of relying solely on middleware.","status":"published","published":"2026-05-11T15:54:24Z","modified":"2026-05-14T20:38:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:40:09.033429Z"}],"nvd":[{"id":"CVE-2026-44575","description":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.","status":"published","published":"2026-05-13T17:16:22.907Z","modified":"2026-10-26T17:10:03.27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-288","CWE-551"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"CVE-2026-44575","title":"Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes","description":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.","status":"published","published":"2026-05-13T16:54:39.455Z","modified":"2026-10-28T02:30:55.57226294Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"GHSA-267c-6grr-h53f","title":"Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes","description":"### Impact\n\nApp Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted `.rsc` and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check.\n\n### Fix\n\nWe now include App Router transport variants when generating middleware matchers, so middleware protections are applied consistently to those requests as well as to the normal page URL.\n\n### Workarounds\n\nIf you cannot upgrade immediately, enforce authorization in the underlying route or page logic instead of relying solely on middleware.","status":"published","published":"2026-05-11T15:54:24Z","modified":"2026-09-10T03:51:03.970900692Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"CLSA-2026-1786995617","title":"TuxCare security update for 22 packages (9 CVEs)","description":"TuxCare rebuilt 22 packages to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.","status":"withdrawn","published":"2026-08-17T19:40:17Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1792195750","title":"TuxCare security update for create-next-app (9 CVEs)","description":"TuxCare rebuilt create-next-app to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.","status":"published","published":"2026-10-17T00:09:06Z","modified":"2026-10-17T01:30:11.401593394Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792196728","title":"TuxCare security update for @next/eslint-plugin-next (9 CVEs)","description":"TuxCare rebuilt @next/eslint-plugin-next to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.","status":"published","published":"2026-10-17T00:25:24Z","modified":"2026-10-17T01:30:11.55390341Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792206304","title":"TuxCare security update for @next/bundle-analyzer (9 CVEs)","description":"TuxCare rebuilt @next/bundle-analyzer to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.","status":"published","published":"2026-10-17T03:05:03Z","modified":"2026-10-17T07:00:40.079556286Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792256964","title":"TuxCare security update for next-rspack (9 CVEs)","description":"TuxCare rebuilt next-rspack to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.","status":"published","published":"2026-10-17T17:09:20Z","modified":"2026-10-17T19:00:44.322169627Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792272246","title":"TuxCare security update for @next/plugin-storybook (9 CVEs)","description":"TuxCare rebuilt @next/plugin-storybook to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.","status":"published","published":"2026-10-17T21:24:04Z","modified":"2026-10-18T01:30:34.388375779Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792293016","title":"TuxCare security update for @next/polyfill-module (9 CVEs)","description":"TuxCare rebuilt @next/polyfill-module to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.","status":"published","published":"2026-10-18T03:10:14Z","modified":"2026-10-18T07:15:11.70271409Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792304741","title":"TuxCare security update for @next/polyfill-nomodule (9 CVEs)","description":"TuxCare rebuilt @next/polyfill-nomodule to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.","status":"published","published":"2026-10-18T06:25:39Z","modified":"2026-10-18T07:15:17.099092408Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792326304","title":"TuxCare security update for @next/react-refresh-utils (9 CVEs)","description":"TuxCare rebuilt @next/react-refresh-utils to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.","status":"published","published":"2026-10-18T12:25:02Z","modified":"2026-10-18T13:15:59.504340743Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792338235","title":"TuxCare security update for @next/third-parties (9 CVEs)","description":"TuxCare rebuilt @next/third-parties to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.","status":"published","published":"2026-10-18T15:43:51Z","modified":"2026-10-18T19:15:41.362849663Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792346470","title":"TuxCare security update for @next/swc-linux-x64-gnu (9 CVEs)","description":"TuxCare rebuilt @next/swc-linux-x64-gnu to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.","status":"published","published":"2026-10-18T18:01:08Z","modified":"2026-10-18T19:16:07.414551087Z","updated_at":"2026-11-02T15:43:52.782414Z"},{"id":"CLSA-2026-1792358599","title":"TuxCare security update for @next/codemod (9 CVEs)","description":"TuxCare rebuilt @next/codemod to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.","status":"published","published":"2026-10-18T21:23:16Z","modified":"2026-10-19T07:46:00.627970311Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792364004","title":"TuxCare security update for @next/mdx (9 CVEs)","description":"TuxCare rebuilt @next/mdx to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.","status":"published","published":"2026-10-18T22:53:22Z","modified":"2026-10-19T07:46:06.753283783Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792367391","title":"TuxCare security update for @next/swc-linux-arm64-gnu (9 CVEs)","description":"TuxCare rebuilt @next/swc-linux-arm64-gnu to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.","status":"published","published":"2026-10-18T23:49:49Z","modified":"2026-10-19T07:46:32.203017239Z","updated_at":"2026-11-02T15:43:53.353888Z"},{"id":"ROOT-APP-NPM-CVE-2026-44575","title":"CVE-2026-44575 in next - Patched by Root","description":"Root has patched CVE-2026-44575 in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-28T07:43:05Z","modified":"2026-09-28T08:15:04.211799828Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}