---
id: "CVE-2026-45109"
kind: "vulnerability"
aliases: ["CVE-2026-45109", "GHSA-26hh-7cqf-hhc6"]
title: "Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up"
severity: "high"
cvss: 7.5
epss: 0.00602
exploited: false
status: "open"
category: "runtime"
products: [{"name": "next", "fixed": ["15.5.18"], "affected": ">= 15.2.0, < 15.5.18", "ecosystem": "npm"}, {"name": "next", "fixed": ["16.2.6"], "affected": ">= 16.0.0, < 16.2.6", "ecosystem": "npm"}, {"name": "vercel next.js", "fixed": ["15.5.18"], "affected": ">= 15.2.0, < 15.5.18", "ecosystem": "vendor"}, {"name": "vercel next.js", "fixed": ["16.2.6"], "affected": ">= 16.0.0, < 16.2.6", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["app-router", "cwe-288", "cwe-358", "middleware", "next.js", "runtime", "self-hosted", "turbopack"]
not_affected_if: ["no-middleware-ts", "version-outside-affected-ranges"]
published_at: "2026-05-11T16:21:19+00:00"
first_seen_at: "2026-11-04T03:31:21+00:00"
updated_at: "2026-11-04T03:46:40+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-26hh-7cqf-hhc6", "first_seen_at": "2026-11-04T03:31:21+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45109", "first_seen_at": "2026-11-04T03:46:40+00:00"}]
---

# Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

Next.js applications using the App Router can have their middleware skipped through segment-prefetch routes, because an earlier fix for CVE-2026-44575 did not cover middleware.ts when built with Turbopack. An attacker can reach routes that middleware was meant to guard.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:next affected >= 15.2.0, < 15.5.18 fixed 15.5.18
- npm:next affected >= 16.0.0, < 16.2.6 fixed 16.2.6
- vendor:vercel next.js affected >= 15.2.0, < 15.5.18 fixed 15.5.18
- vendor:vercel next.js affected >= 16.0.0, < 16.2.6 fixed 16.2.6

## How to check

- Check the installed Next.js version with `next --version` or the `next` entry in package.json and the lockfile.
- Look for a `middleware.ts` file in the project and check whether the app builds with Turbopack.
- Compare the installed version against the affected ranges: `15.2.0` to below `15.5.18`, and `16.0.0` to below `16.2.6`.

## Fix

- Next.js 15.x: upgrade to `15.5.18`
- Next.js 16.x: upgrade to `16.2.6`

## Timeline

- 2026-11-04T03:31:21+00:00 ghsa https://github.com/advisories/GHSA-26hh-7cqf-hhc6
- 2026-11-04T03:46:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-45109

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/vercel/next.js/security-advisories/GHSA-26hh-7cqf-hhc6
- [advisory] Maintainer's advisory: github.com https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f
- [advisory] Maintainer's advisory: github.com https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6
- [fix] Release: github.com https://github.com/vercel/next.js/releases/tag/v15.5.18
- [fix] Release: github.com https://github.com/vercel/next.js/releases/tag/v16.2.6

## From the sources

### Impact


It was found that the fix addressing [CVE-2026-44575](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f) did not apply to `middleware.ts` with Turbopack. Refer to  [CVE-2026-44575](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f) for further details.

### References 

- [CVE CVE-2026-44575](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_