CVE-2026-45109: Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
Impact
It was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. Refer to CVE-2026-44575 for further details.
References
- CVE CVE-2026-44575
Other sources
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.2.6 - Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 15.5.18 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.5.18 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.2.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45109?
CVE-2026-45109 is classified as a moderate severity vulnerability in specific versions of the Next.js framework.
How do I fix CVE-2026-45109?
To mitigate CVE-2026-45109, upgrade to Next.js version 16.2.6 or version 15.5.18.
Which versions of Next.js are affected by CVE-2026-45109?
CVE-2026-45109 affects Next.js versions from 16.0.0 to 16.2.6 and from 15.2.0 to 15.5.18.
What components are involved in CVE-2026-45109?
CVE-2026-45109 involves the middleware.ts file in Next.js when using Turbopack.
Is CVE-2026-45109 related to any previous vulnerabilities?
CVE-2026-45109 is related to CVE-2026-44575 as it concerns a fix that did not apply as intended.