CVE-2026-45109CWE-288CWE-358

CVE-2026-45109

High · published May 13, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
54.8
In the wild
Unconfirmed
What it is

Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00761 · 54.8th percentile
Weaknesses
CWE-288 · Authentication Bypass Using an Alternate Path or Channel; CWE-358 · Improperly Implemented Security Check for Standard
Published
2026-05-13T22:16Z
Affected products (2)
ProductVersionsFixed in
vercel/next.js≥ 15.2.0, < 15.5.1815.5.18
vercel/next.js≥ 16.0.0, < 16.2.616.2.6
References (8)
https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6 · [email protected]https://access.redhat.com/errata/RHSA-2026:34608 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:37272 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:40974 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:54435 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/security/cve/CVE-2026-45109 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://bugzilla.redhat.com/show_bug.cgi?id=2477190 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45109.json · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
EPSS history
Timeline
  • 13 MAY 17:11Z
    Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
    cvelistv5