{"id":"CVE-2026-45109","state":"PUBLISHED","title":"Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes","description":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.","publishedAt":"2026-05-13T17:11:07.275Z","updatedAt":"2026-08-13T12:04:29.810Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["vercel next.js"],"affected":[{"vendor":"vercel","product":"next.js","versions":[{"version":">= 15.2.0, < 15.5.17","status":"affected"},{"version":">= 16.0.0, < 16.2.6","status":"affected"}]}],"references":["https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6","https://access.redhat.com/security/cve/CVE-2026-45109","https://bugzilla.redhat.com/show_bug.cgi?id=2477190","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45109.json","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:54435"],"weaknesses":["CWE-288","CWE-358"],"ingestedAt":"2026-10-29T20:12:07.131Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/45xxx/CVE-2026-45109.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-45109","state":"PUBLISHED","datePublished":"2026-05-13T17:11:07.275Z","dateUpdated":"2026-08-13T12:04:29.810Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-05-08T19:27:26.699Z"},"containers":{"cna":{"title":"Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes","descriptions":[{"lang":"en","value":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6."}],"affected":[{"vendor":"vercel","product":"next.js","versions":[{"version":">= 15.2.0, < 15.5.17","status":"affected"},{"version":">= 16.0.0, < 16.2.6","status":"affected"}]}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6","name":"https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-288","lang":"en","description":"CWE-288: Authentication Bypass Using an Alternate Path or Channel","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-05-13T17:11:07.275Z"},"source":{"advisory":"GHSA-26hh-7cqf-hhc6","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-13T18:39:20.946868Z","id":"CVE-2026-45109","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-13T18:39:29.674Z"}},{"title":"next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack","descriptions":[{"lang":"en","value":"A flaw was found in Next.js. A remote unauthenticated attacker could exploit a bypass in a security fix when using middleware.ts with Turbopack. This vulnerability could lead to the disclosure of sensitive information."}],"affected":[{"vendor":"Red Hat","product":"Streams for Apache Kafka 2.9.4","packageName":"next","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:2.9::el9"]},{"vendor":"Red Hat","product":"Red Hat Trusted Artifact Signer 1.3","packageName":"rhtas/rekor-search-ui-rhel9","defaultStatus":"affected","versions":[{"version":"1783958622","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:trusted_artifact_signer:1.3::el9"]},{"vendor":"Red Hat","product":"Red Hat Trusted Artifact Signer 1.4","packageName":"rhtas/rekor-search-ui-rhel9","defaultStatus":"affected","versions":[{"version":"1783327185","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:trusted_artifact_signer:1.4::el9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"firefox","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"thunderbird","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"firefox","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"firefox","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"thunderbird","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"firefox","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"thunderbird","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-cuda-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-gaudi-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-rocm-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/disk-image-cuda-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"]},{"vendor":"Red Hat","product":"streams for Apache Kafka 3","packageName":"next","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:3"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-45109","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477190","name":"RHBZ#2477190","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45109.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40974","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37272","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34608","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54435","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-358","description":"Improperly Implemented Security Check for Standard","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-08-13T12:04:29.810Z"},"datePublic":"2026-05-13T17:11:07.275Z","solutions":[{"lang":"en","value":"RHSA-2026:40974: Red Hat Trusted Artifact Signer 1.3"},{"lang":"en","value":"RHSA-2026:37272: Red Hat Trusted Artifact Signer 1.4"},{"lang":"en","value":"RHSA-2026:34608: Streams for Apache Kafka 2.9.4"},{"lang":"en","value":"RHSA-2026:54435: Streams for Apache Kafka 3.2.1"}],"timeline":[{"lang":"en","time":"2026-05-13T18:01:23.402Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-05-13T17:11:07.275Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}