{"id":"CVE-2026-45109","aliases":["EUVD-2026-30085","GHSA-26hh-7cqf-hhc6","ROOT-APP-NPM-CVE-2026-45109"],"status":"published","title":"Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes","description":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00854,"percentile":0.5864,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-288","CWE-358"],"published":"2026-05-11T16:21:19Z","modified":"2026-11-05T03:31:34Z","fixes":[{"ecosystem":"npm","package":"next","fixed_in":["15.5.18","16.2.6"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"next","fixed_in":["16.1.6-aikido.4","16.2.5-aikido.1","16.1.7-aikido.1","16.1.6-aikido.5","15.5.15-aikido.2","15.5.10-aikido.6","16.1.7-aikido.2","15.5.15-aikido.3","16.1.6-aikido.6","15.5.15-aikido.4","16.1.6-aikido.7","16.1.7-aikido.3","16.2.5-aikido.3","16.2.5-aikido.2","16.1.6-aikido.8","15.5.18-aikido.1","15.5.18-aikido.2","15.5.18-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/next","fixed_in":["16.1.6-root.io.2","15.5.15-root.io.1","16.1.6-root.io.3","16.2.5-root.io.1","16.1.6-root.io.4","16.1.7-root.io.1","16.1.6-root.io.5","15.5.15-root.io.2","15.5.10-root.io.6","16.1.7-root.io.2","15.5.15-root.io.3","16.1.6-root.io.6","15.5.15-root.io.4","16.1.6-root.io.7","16.1.7-root.io.3","16.2.5-root.io.3","16.2.5-root.io.2","16.1.6-root.io.8","15.5.18-root.io.1","15.5.18-root.io.2","15.5.18-root.io.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.0"},{"fixed":"15.5.18"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"fixed":"16.2.6"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.2.0"},{"fixed":"15.5.18"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"16.2.6"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.6-aikido.4"},{"fixed":"16.2.5-aikido.1"},{"fixed":"16.1.7-aikido.1"},{"fixed":"16.1.6-aikido.5"},{"fixed":"15.5.15-aikido.2"},{"fixed":"15.5.10-aikido.6"},{"fixed":"16.1.7-aikido.2"},{"fixed":"15.5.15-aikido.3"},{"fixed":"16.1.6-aikido.6"},{"fixed":"15.5.15-aikido.4"},{"fixed":"16.1.6-aikido.7"},{"fixed":"16.1.7-aikido.3"},{"fixed":"16.2.5-aikido.3"},{"fixed":"16.2.5-aikido.2"},{"fixed":"16.1.6-aikido.8"},{"fixed":"15.5.18-aikido.1"},{"fixed":"15.5.18-aikido.2"},{"fixed":"15.5.18-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.6-root.io.2"},{"fixed":"15.5.15-root.io.1"},{"fixed":"16.1.6-root.io.3"},{"fixed":"16.2.5-root.io.1"},{"fixed":"16.1.6-root.io.4"},{"fixed":"16.1.7-root.io.1"},{"fixed":"16.1.6-root.io.5"},{"fixed":"15.5.15-root.io.2"},{"fixed":"15.5.10-root.io.6"},{"fixed":"16.1.7-root.io.2"},{"fixed":"15.5.15-root.io.3"},{"fixed":"16.1.6-root.io.6"},{"fixed":"15.5.15-root.io.4"},{"fixed":"16.1.6-root.io.7"},{"fixed":"16.1.7-root.io.3"},{"fixed":"16.2.5-root.io.3"},{"fixed":"16.2.5-root.io.2"},{"fixed":"16.1.6-root.io.8"},{"fixed":"15.5.18-root.io.1"},{"fixed":"15.5.18-root.io.2"},{"fixed":"15.5.18-root.io.3"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat trusted artifact signer 1.3"},{"vendor":"red hat","product":"red hat trusted artifact signer 1.4"},{"vendor":"red hat","product":"streams for apache kafka 2.9.4"},{"vendor":"red hat","product":"streams for apache kafka 3"},{"vendor":"vercel","product":"next.js"}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f","tags":["x_refsource_MISC","advisory","web"]},{"url":"https://github.com/vercel/next.js/releases/tag/v15.5.18","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/vercel/next.js/releases/tag/v16.2.6","tags":["x_refsource_MISC","web"]},{"url":"https://vercel.com/changelog/next-js-may-2026-security-release","tags":["x_refsource_MISC","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45109","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477190","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45109.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40974","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37272","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34608","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54435","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45109","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-26hh-7cqf-hhc6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45109.json","tags":["advisory"]},{"url":"https://github.com/vercel/next.js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-45109","title":"Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes","description":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.","status":"published","published":"2026-05-13T17:11:07.275Z","modified":"2026-11-04T03:31:29.717Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-288","CWE-358"],"updated_at":"2026-11-04T04:50:53.041166Z"}],"euvd":[{"id":"EUVD-2026-30085","description":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.","status":"published","published":"2026-05-13T17:11:07Z","modified":"2026-11-04T03:31:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-04T04:58:07.231207Z"}],"ghsa":[{"id":"GHSA-26hh-7cqf-hhc6","title":"Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up","description":"### Impact\n\n\nIt was found that the fix addressing [CVE-2026-44575](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f) did not apply to `middleware.ts` with Turbopack. Refer to  [CVE-2026-44575](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f) for further details.\n\n### References \n\n- [CVE CVE-2026-44575](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f)","status":"published","published":"2026-05-11T16:21:19Z","modified":"2026-11-04T03:30:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-288","CWE-358"],"updated_at":"2026-11-04T03:52:50.391589Z"}],"nvd":[{"id":"CVE-2026-45109","description":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.","status":"published","published":"2026-05-13T18:16:19.283Z","modified":"2026-11-04T04:17:36.737Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-288","CWE-358"],"updated_at":"2026-11-04T06:53:16.37612Z"}],"osv":[{"id":"CVE-2026-45109","title":"Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes","description":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.","status":"published","published":"2026-05-13T17:11:07.275Z","modified":"2026-11-05T03:31:34.032150052Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-288"],"updated_at":"2026-11-05T07:12:19.426937Z"},{"id":"GHSA-26hh-7cqf-hhc6","title":"Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up","description":"### Impact\n\n\nIt was found that the fix addressing [CVE-2026-44575](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f) did not apply to `middleware.ts` with Turbopack. Refer to  [CVE-2026-44575](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f) for further details.\n\n### References \n\n- [CVE CVE-2026-44575](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f)","status":"published","published":"2026-05-11T16:21:19Z","modified":"2026-09-10T03:50:45.324330779Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"ROOT-APP-NPM-CVE-2026-45109","title":"CVE-2026-45109 in next - Patched by Root","description":"Root has patched CVE-2026-45109 in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-09T10:43:15Z","modified":"2026-10-09T11:15:02.585694667Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}