REDHAT-BUG-2477190: High severity Next.js Next.js vulnerability

Q: Which deployments are affected?

Deployments using Next.js versions from 15.2.0 up to, but not including, 15.5.18, or affected 16.x versions before 16.2.6, are affected when they use middleware.ts with Turbopack.

Q: What configuration is required for exploitation?

The issue specifically concerns middleware.ts used with Turbopack. The provided information does not indicate that applications not using this combination are affected.

Q: Which versions resolve the issue?

Upgrade to Next.js 15.5.18 or 16.2.6. These releases include the correction for the incomplete CVE-2026-44575 fix in middleware.ts with Turbopack.

Published May 13, 2026

Updated

Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.

Affected Software

1 affected component

Next.js Next.js>15.2.0<=15.5.18, >16.2.6<16.2.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade next.js to a version that resolves this vulnerability.
Fixed in 15.5.18
Upgrade
Upgrade next.js to a version that resolves this vulnerability.
Fixed in 16.2.6

Event History

May 13, 2026

Data Sourced

via Red Hat·06:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are affected?

Deployments using Next.js versions from 15.2.0 up to, but not including, 15.5.18, or affected 16.x versions before 16.2.6, are affected when they use middleware.ts with Turbopack.

What configuration is required for exploitation?

The issue specifically concerns middleware.ts used with Turbopack. The provided information does not indicate that applications not using this combination are affected.

Which versions resolve the issue?

Upgrade to Next.js 15.5.18 or 16.2.6. These releases include the correction for the incomplete CVE-2026-44575 fix in middleware.ts with Turbopack.

REDHAT-BUG-2477190: High severity Next.js Next.js vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What configuration is required for exploitation?

Which versions resolve the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What configuration is required for exploitation?

Which versions resolve the issue?