Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
Priority MEDIUM 40CWE-288Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 4 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-288.
Summary
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00854 58th percentileScored 2026-11-07
Fix Partial next.js (vercel): 15.5.17, 16.2.6next (npm): 15.5.18, 16.2.6Red Hat: 4 advisoriesRed Hat: 4 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vercel | next.js | 15.2.0 to before 15.5.17; 16.0.0 to before 16.2.6 | 15.5.17, 16.2.6 | Patch available | CNA |
| — | next (npm) | 15.2.0 to before 15.5.18 | 15.5.18 | Patch available | GHSA-26hh-7cqf-hhc6 |
| — | next (npm) | 16.0.0 to before 16.2.6 | 16.2.6 | Patch available | GHSA-26hh-7cqf-hhc6 |
- next.js Vendorvercel Affected 15.2.0 to before 15.5.17; 16.0.0 to before 16.2.6 Fixed in 15.5.17, 16.2.6 Patch available CNA
- next (npm) Vendor— Affected 15.2.0 to before 15.5.18 Fixed in 15.5.18 Patch available GHSA-26hh-7cqf-hhc6
- next (npm) Vendor— Affected 16.0.0 to before 16.2.6 Fixed in 16.2.6 Patch available GHSA-26hh-7cqf-hhc6
Remediation
- Fix · CNA next.js (vercel) Fixed in 15.5.17, 16.2.6
- Fix · GHSA-26hh-7cqf-hhc6 next (npm) Fixed in 15.5.18 Advisory →
- Fix · GHSA-26hh-7cqf-hhc6 next (npm) Fixed in 16.2.6 Advisory →
Red Hat 4 advisories
- RHSA-2026:54435 Released 2026-08-12 · Red Hat rating ImportantStreams for Apache Kafka 3.2.1 release and security update
- Streams for Apache Kafka 3.2.1
- RHSA-2026:40974 Released 2026-07-16 · Red Hat rating ImportantRHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
- RHSA-2026:37272 Released 2026-07-09 · Red Hat rating ImportantRHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
Show 1 more Red Hat advisories
- RHSA-2026:34608 Released 2026-07-02 · Red Hat rating ImportantStreams for Apache Kafka 2.9.4 release and security update
- Streams for Apache Kafka 2.9.4
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| Red Hat Trusted Artifact Signer 1.3 | Fixed | RHSA-2026:40974 |
| Red Hat Trusted Artifact Signer 1.4 | Fixed | RHSA-2026:37272 |
| Streams for Apache Kafka 2.9.4 | Fixed | RHSA-2026:34608 |
| Streams for Apache Kafka 3.2.1 | Fixed | RHSA-2026:54435 |
Not affected: 6 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Trusted Artifact Signer 1.3
- Red Hat Trusted Artifact Signer 1.4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-45109
- 2026-10-03 Alias added: GHSA-26hh-7cqf-hhc6
- 2026-10-25 EPSS moved to the below the 50th percentile
- 2026-11-04 EPSS moved to the 50th–90th percentile
- 2026-11-04 Weakness changed · GHSA-26hh-7cqf-hhc6
- 2026-11-04 8 new references · GHSA-26hh-7cqf-hhc6
- 2026-11-04 4 new references · CNA
References
Advisory 2
Other 12
- https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f
- https://github.com/vercel/next.js/releases/tag/v15.5.18
- https://github.com/vercel/next.js/releases/tag/v16.2.6
- https://vercel.com/changelog/next-js-may-2026-security-release
- https://access.redhat.com/errata/RHSA-2026:34608
- https://access.redhat.com/errata/RHSA-2026:37272
- https://access.redhat.com/errata/RHSA-2026:40974
- https://access.redhat.com/errata/RHSA-2026:54435
- https://access.redhat.com/security/cve/CVE-2026-45109
- https://bugzilla.redhat.com/show_bug.cgi?id=2477190
- https://github.com/vercel/next.js
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45109.json
More vercel Next.js vulnerabilities
- TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
- TI-2025-21309 Authorization Bypass in Next.js Middleware CVSS 3.1CRITICAL 9.1
- TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
- TI-2024-31371 Cache Poisoning in next.js CVSS 3.1HIGH 7.5
- TI-2023-24914 Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch… CVSS 3.1HIGH 7.5
- TI-2026-32490 Next.js: Server-side request forgery in applications using WebSocket upgrades CVSS 3.1HIGH 8.6
Sources
- CVE-2026-45109 · CVE Program
- CVE-2026-45109 · NVD
- FIRST EPSS
- GHSA-26hh-7cqf-hhc6 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-45109 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences