high7.5
CVE-2026-45109Package fixes recorded
Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
It was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. Refer to CVE-2026-44575 for further details.
Recorded fixes — next: 15.5.18 or 16.2.6. Check your release branch.
Exploitation not established
next npm
| Affected range | Recorded fix |
|---|---|
| From 15.2.0 before 15.5.18Semantic versions | 15.5.18 |
Version evidence: OSV · GHSA-26hh-7cqf-hhc6
View original version evidence
{
"ranges": [
{
"events": [
{
"introduced": "15.2.0"
},
{
"fixed": "15.5.18"
}
],
"type": "SEMVER"
}
],
"versions": []
}next npm
| Affected range | Recorded fix |
|---|---|
| From 16.0.0 before 16.2.6Semantic versions | 16.2.6 |
Version evidence: OSV · GHSA-26hh-7cqf-hhc6
View original version evidence
{
"ranges": [
{
"events": [
{
"introduced": "16.0.0"
},
{
"fixed": "16.2.6"
}
],
"type": "SEMVER"
}
],
"versions": []
}