{"id":"CVE-2026-45109","aliases":["GHSA-26hh-7cqf-hhc6"],"title":"Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes","titleSource":"GitHub_M","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"### Impact\n\n\nIt was found that the fix addressing [CVE-2026-44575](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f) did not apply to `middleware.ts` with Turbopack. Refer to  [CVE-2026-44575](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f) for further details.\n\n### References \n\n- [CVE CVE-2026-44575](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f)","severity":"high","score":7.5,"published":"2026-05-11T16:21:19.000Z","modified":"2026-11-04T03:45:10.188Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"npm","name":"next","sources":[{"name":"OSV · GHSA-26hh-7cqf-hhc6","url":"https://osv.dev/vulnerability/GHSA-26hh-7cqf-hhc6"}],"ranges":[{"events":[{"introduced":"15.2.0"},{"fixed":"15.5.18"}],"type":"SEMVER"}],"versions":[],"fixed":["15.5.18"]},{"ecosystem":"npm","name":"next","sources":[{"name":"OSV · GHSA-26hh-7cqf-hhc6","url":"https://osv.dev/vulnerability/GHSA-26hh-7cqf-hhc6"}],"ranges":[{"events":[{"introduced":"16.0.0"},{"fixed":"16.2.6"}],"type":"SEMVER"}],"versions":[],"fixed":["16.2.6"]}],"sourceAffected":[],"references":["https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6","https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f","https://github.com/vercel/next.js/releases/tag/v15.5.18","https://github.com/vercel/next.js/releases/tag/v16.2.6","https://vercel.com/changelog/next-js-may-2026-security-release","https://access.redhat.com/security/cve/CVE-2026-45109","https://bugzilla.redhat.com/show_bug.cgi?id=2477190","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45109.json","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:54435","https://nvd.nist.gov/vuln/detail/CVE-2026-45109","https://github.com/vercel/next.js"],"sources":[{"name":"CVE","id":"CVE-2026-45109","modified":"2026-11-04T03:31:29.717Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"name":"OSV","id":"GHSA-26hh-7cqf-hhc6","modified":"2026-11-04T03:45:10.188462703Z","url":"https://osv.dev/vulnerability/GHSA-26hh-7cqf-hhc6"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},{"source":"redhat-SADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5}],"cve":{"records":[{"id":"CVE-2026-45109","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-05-08T19:27:26.699Z","published":"2026-05-13T17:11:07.275Z","modified":"2026-11-04T03:31:29.717Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-11-04T03:31:29.717Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-05-13T18:39:29.674Z"},{"name":"redhat-SADP","role":"ADP","organizationId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","modified":"2026-08-13T12:04:29.810Z"}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/vercel/next.js/releases/tag/v15.5.18","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/vercel/next.js/releases/tag/v16.2.6","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://vercel.com/changelog/next-js-may-2026-security-release","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://access.redhat.com/security/cve/CVE-2026-45109","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat-SADP"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477190","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat-SADP"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45109.json","tags":["x_sadp-csaf-vex"],"source":"redhat-SADP"},{"url":"https://access.redhat.com/errata/RHSA-2026:40974","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat-SADP"},{"url":"https://access.redhat.com/errata/RHSA-2026:37272","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat-SADP"},{"url":"https://access.redhat.com/errata/RHSA-2026:34608","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat-SADP"},{"url":"https://access.redhat.com/errata/RHSA-2026:54435","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat-SADP"}],"weaknesses":[{"id":"CWE-288","description":"CWE-288: Authentication Bypass Using an Alternate Path or Channel","source":"GitHub_M"},{"id":"CWE-358","description":"Improperly Implemented Security Check for Standard","source":"redhat-SADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-05-13T18:39:20.946868Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"products":[{"vendor":"vercel","name":"next.js","platforms":[],"versions":[{"version":">= 15.2.0, < 15.5.17","status":"affected"},{"version":">= 16.0.0, < 16.2.6","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"vendor":"Red Hat","name":"Streams for Apache Kafka 2.9.4","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:amq_streams:2.9::el9"],"source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"vendor":"Red Hat","name":"Red Hat Trusted Artifact Signer 1.3","platforms":[],"versions":[{"version":"1783958622","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:trusted_artifact_signer:1.3::el9"],"source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"vendor":"Red Hat","name":"Red Hat Trusted Artifact Signer 1.4","platforms":[],"versions":[{"version":"1783327185","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:trusted_artifact_signer:1.4::el9"],"source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:10"],"source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:10"],"source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 7","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:7"],"source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 8","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:8"],"source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 8","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:8"],"source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:9"],"source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:9"],"source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux AI (RHEL AI) 3","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux AI (RHEL AI) 3","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux AI (RHEL AI) 3","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux AI (RHEL AI) 3","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"vendor":"Red Hat","name":"streams for Apache Kafka 3","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:amq_streams:3"],"source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"}],"remediation":[{"text":"RHSA-2026:40974: Red Hat Trusted Artifact Signer 1.3","source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"text":"RHSA-2026:37272: Red Hat Trusted Artifact Signer 1.4","source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"text":"RHSA-2026:34608: Streams for Apache Kafka 2.9.4","source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"text":"RHSA-2026:54435: Streams for Apache Kafka 3.2.1","source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"},{"text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.","source":"redhat-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-45109"}],"observedAt":"2026-11-04T04:13:03.740Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:00:33.317Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-04T04:20:33.862Z","attemptedAt":"2026-11-04T04:20:33.862Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-04T04:20:33.871Z","attemptedAt":"2026-11-04T04:20:33.871Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-04T04:20:33.861Z","attemptedAt":"2026-11-04T04:20:33.861Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-04T04:20:33.864Z","attemptedAt":"2026-11-04T04:20:33.864Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-30085","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30085","modified":"Nov 4, 2026, 3:31:29 AM","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-04T04:20:33.861Z"},{"source":"NVD","id":"CVE-2026-45109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45109","modified":"2026-11-04T04:17:36.737","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-04T04:20:33.862Z"},{"source":"NVD","id":"CVE-2026-45109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45109","modified":"2026-11-04T04:17:36.737","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-04T04:20:33.862Z"},{"source":"FIRST EPSS","id":"CVE-2026-45109","url":"https://www.first.org/epss/","probability":0.00602,"percentile":0.48844,"date":"2026-11-03","checkedAt":"2026-11-04T04:20:33.864Z"},{"source":"GitHub Advisory Database","id":"GHSA-26hh-7cqf-hhc6","url":"https://github.com/advisories/GHSA-26hh-7cqf-hhc6","modified":"2026-11-04T03:30:52Z","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-04T04:20:33.871Z"}],"aiSummary":null}