Packages / next / Security

HighVulnerabilityGHSA-26hh-7cqf-hhc6CVE-2026-45109Published 11 May 2026

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

Affected releases · next

  • 16.x16.0.0 – 16.2.5Fixed in 16.2.6
  • 15.x15.2.0 – 15.5.16Fixed in 15.5.18

On 16.x, the newest line:

npm install next@16.2.6
16.x

  1. Affected

    16.0.0 – 16.2.5

    26 releases

  2. Fixed

    16.2.6 – 16.4.2

    19 releases, latest

15.x

  1. Not affected

    15.0.0 – 15.1.12

    22 releases

  2. Affected

    15.2.0 – 15.5.16

    49 releases

  3. Fixed

    15.5.18 – 15.5.28

    11 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Impact

It was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. Refer to CVE-2026-44575 for further details.

References