{"id":"CVE-2026-45109","kind":"vulnerability","aliases":["CVE-2026-45109","GHSA-26hh-7cqf-hhc6"],"related":[],"title":"Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up","description":"### Impact\n\n\nIt was found that the fix addressing [CVE-2026-44575](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f) did not apply to `middleware.ts` with Turbopack. Refer to  [CVE-2026-44575](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f) for further details.\n\n### References \n\n- [CVE CVE-2026-44575](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f)","summary":"Next.js applications using the App Router can have their middleware skipped through segment-prefetch routes, because an earlier fix for CVE-2026-44575 did not cover middleware.ts when built with Turbopack. An attacker can reach routes that middleware was meant to guard.","severity":"high","cvss":7.5,"epss":0.00602,"exploited":false,"exploited_at":null,"products":[{"name":"next","fixed":["15.5.18"],"affected":">= 15.2.0, < 15.5.18","ecosystem":"npm"},{"name":"next","fixed":["16.2.6"],"affected":">= 16.0.0, < 16.2.6","ecosystem":"npm"},{"name":"vercel next.js","fixed":["15.5.18"],"affected":">= 15.2.0, < 15.5.18","ecosystem":"vendor"},{"name":"vercel next.js","fixed":["16.2.6"],"affected":">= 16.0.0, < 16.2.6","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["app-router","cwe-288","cwe-358","middleware","next.js","runtime","self-hosted","turbopack"],"not_affected_if":["no-middleware-ts","version-outside-affected-ranges"],"how_to_check":"- Check the installed Next.js version with `next --version` or the `next` entry in package.json and the lockfile.\n- Look for a `middleware.ts` file in the project and check whether the app builds with Turbopack.\n- Compare the installed version against the affected ranges: `15.2.0` to below `15.5.18`, and `16.0.0` to below `16.2.6`.","fix":"- Next.js 15.x: upgrade to `15.5.18`\n- Next.js 16.x: upgrade to `16.2.6`","status":"open","published_at":"2026-05-11T16:21:19+00:00","first_seen_at":"2026-11-04T03:31:21+00:00","triaged_at":"2026-11-04T03:32:51+00:00","updated_at":"2026-11-04T03:46:40+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-04T03:32:51Z","model":"claude-haiku-5-5","output":{"fix":"- Next.js 15.x: upgrade to `15.5.18`\n- Next.js 16.x: upgrade to `16.2.6`","reach":"internet","title":"Next.js: middleware bypass in App Router via segment-prefetch routes","impact":"medium","summary":"Next.js applications using the App Router can have their middleware skipped through segment-prefetch routes, because an earlier fix for CVE-2026-44575 did not cover middleware.ts when built with Turbopack. An attacker can reach routes that middleware was meant to guard.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["next.js","app-router","turbopack","middleware","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reaches routes that middleware was meant to protect","analyst_note":"","how_to_check":"- Check the installed Next.js version with `next --version` or the `next` entry in package.json and the lockfile.\n- Look for a `middleware.ts` file in the project and check whether the app builds with Turbopack.\n- Compare the installed version against the affected ranges: `15.2.0` to below `15.5.18`, and `16.0.0` to below `16.2.6`.","plain_action":"","needs_analyst":false,"not_affected_if":["version-outside-affected-ranges","no-middleware-ts"],"who_is_affected":"Applications built with the Next.js App Router that rely on middleware.ts for access control or routing, especially when built with Turbopack. Teams on versions outside the affected ranges, or on Pages Router apps without middleware.ts, are not affected according to the sources' version ranges; the sources do not say more about configuration.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001176,"input_tokens":4415,"output_tokens":1469,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':21A,29A,73B,103C,118C,129C '-288':41B '-358':43B '-44575':74B,104C,119C,130C '-45109':22A,30A '/vercel/next.js/security/advisories/ghsa-267c-6grr-h53f)':107C,122C,133C '26hh':25A '7cqf':26A 'address':101C 'app':8A,38B,55B 'app-rout':37B 'appli':110C 'applic':10A,52B 'attack':84B 'built':80B 'bypass':6A 'cover':77B 'cve':20A,28A,72B,102C,117C,127C,128C 'cwe':40B,42B 'detail':125C 'earlier':69B 'fix':17A,70B,100C 'follow':19A 'follow-up':18A 'found':97C 'ghsa':24A 'ghsa-26hh-7cqf-hhc6':23A 'github.com':106C,121C,132C 'github.com/vercel/next.js/security/advisories/ghsa-267c-6grr-h53f)':105C,120C,131C 'guard':93B 'hhc6':27A 'host':49B 'impact':94C 'incomplet':16A 'meant':91B 'middlewar':4A,44B,60B,89B 'middleware.ts':78B,112C 'next':31A,32A 'next.js':1A,34A,36A,45B,51B 'prefetch':14A,65B 'proxi':5A 'reach':86B 'refer':115C,126C 'rout':15A,66B,87B 'router':9A,39B,56B 'runtim':46B 'segment':13A,64B 'segment-prefetch':12A,63B 'self':48B 'self-host':47B 'skip':61B 'turbopack':50B,82B,114C 'use':53B 'vercel':33A,35A 'via':11A","nicknames":[],"mitigations":[],"who_affected":"Applications built with the Next.js App Router that rely on middleware.ts for access control or routing, especially when built with Turbopack. Teams on versions outside the affected ranges, or on Pages Router apps without middleware.ts, are not affected according to the sources' version ranges; the sources do not say more about configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["next","nextjs","vercelnextjs"],"ptokens":["next","nextjs","vercel"],"labels":["approuter","cwe288","cwe358","high","middleware","nextjs","npm","runtime","selfhosted","turbopack","vendor"],"campaign_type":null,"first_public_at":"2026-05-07T19:42:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-26hh-7cqf-hhc6","url":"https://github.com/advisories/GHSA-26hh-7cqf-hhc6","severity":"high","published_at":"2026-05-11T16:21:19+00:00","modified_at":"2026-11-04T03:30:52+00:00","first_seen_at":"2026-11-04T03:31:21+00:00","fetched_at":"2026-11-04T03:36:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-45109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45109","severity":null,"published_at":"2026-05-13T18:16:19+00:00","modified_at":"2026-10-26T14:10:00+00:00","first_seen_at":"2026-11-04T03:46:40+00:00","fetched_at":"2026-11-04T03:46:40+00:00","note":null}],"documents":[{"id":63582,"url":"https://api.github.com/repos/vercel/next.js/security-advisories/GHSA-26hh-7cqf-hhc6","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":63583,"url":"https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":63584,"url":"https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-05-07T19:42:05+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":63585,"url":"https://github.com/vercel/next.js/releases/tag/v15.5.18","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":63586,"url":"https://github.com/vercel/next.js/releases/tag/v16.2.6","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}