Live › vulnerability › CVE-2026-45109
Next.js applications using the App Router can have their middleware skipped through segment-prefetch routes, because an earlier fix for CVE-2026-44575 did not cover middleware.ts when built with Turbopack. An attacker can reach routes that middleware was meant to guard.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 03:31 UTC, 0h before NVD. All times on this page are UTC.
Applications built with the Next.js App Router that rely on middleware.ts for access control or routing, especially when built with Turbopack. Teams on versions outside the affected ranges, or on Pages Router apps without middleware.ts, are not affected according to the sources' version ranges; the sources do not say more about configuration.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| next | npm | >= 15.2.0, < 15.5.18 | 15.5.18 |
| next | npm | >= 16.0.0, < 16.2.6 | 16.2.6 |
| vercel next.js | vendor | >= 15.2.0, < 15.5.18 | 15.5.18 |
| vercel next.js | vendor | >= 16.0.0, < 16.2.6 | 16.2.6 |
next --versionnextmiddleware.ts file in the project and check whether the app builds with Turbopack.15.2.0 to below 15.5.18, and 16.0.0 to below 16.2.6.15.5.1816.2.6Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
It was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. Refer to CVE-2026-44575 for further details.
This page as .md · .json · in your agent: get_signal("CVE-2026-45109")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.