CVE-2026-45109

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45109
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45109.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45109
Aliases
Downstream
CGA (6)
CLEANSTART (1)
MINI (4)
ROOT (1)
Published
2026-05-13T17:11:07Z
Modified
2026-10-21T02:30:46Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
Details

Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-288"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45109.json"
}
References

Affected packages

Git / github.com/vercel/next.js

Affected ranges

Type
GIT
Repo
https://github.com/vercel/next.js
Events
Introduced
b0416fbb44d1d148b6322ed79b6448d588260e49
Fixed
9ff92cebcaa6ba4e7463b6fd037a8510ba9b81ec
Introduced
950609f96f694c5475d18cd2d72a0052ca04d4b9
Fixed
ee6e79b1792a4d401ddf2480f40a83549fe8e722
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "range":  [
                {
                    "introduced":  "15.2.0"
                },
                {
                    "fixed":  "15.5.18"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "range":  [
                {
                    "introduced":  "16.0.0"
                },
                {
                    "fixed":  "16.2.6"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Affected versions

v15.*
v15.2.0
v15.2.1
v15.2.1-canary.0
v15.2.1-canary.1
v15.2.1-canary.2
v15.2.1-canary.3
v15.2.1-canary.4
v15.2.1-canary.5
v15.2.1-canary.6
v15.2.2-canary.0
v15.2.2-canary.1
v15.2.2-canary.2
v15.2.2-canary.3
v15.2.2-canary.4
v15.2.2-canary.5
v15.2.2-canary.6
v15.2.2-canary.7
v15.3.0
v15.3.0-canary.0
v15.3.0-canary.1
v15.3.0-canary.10
v15.3.0-canary.11
v15.3.0-canary.12
v15.3.0-canary.13
v15.3.0-canary.14
v15.3.0-canary.15
v15.3.0-canary.16
v15.3.0-canary.17
v15.3.0-canary.18
v15.3.0-canary.19
v15.3.0-canary.2
v15.3.0-canary.20
v15.3.0-canary.21
v15.3.0-canary.22
v15.3.0-canary.23
v15.3.0-canary.24
v15.3.0-canary.25
v15.3.0-canary.26
v15.3.0-canary.27
v15.3.0-canary.28
v15.3.0-canary.29
v15.3.0-canary.3
v15.3.0-canary.30
v15.3.0-canary.31
v15.3.0-canary.32
v15.3.0-canary.33
v15.3.0-canary.34
v15.3.0-canary.35
v15.3.0-canary.36
v15.3.0-canary.37
v15.3.0-canary.38
v15.3.0-canary.39
v15.3.0-canary.4
v15.3.0-canary.40
v15.3.0-canary.41
v15.3.0-canary.42
v15.3.0-canary.43
v15.3.0-canary.44
v15.3.0-canary.45
v15.3.0-canary.46
v15.3.0-canary.5
v15.3.0-canary.6
v15.3.0-canary.7
v15.3.0-canary.8
v15.3.0-canary.9
v15.3.1-canary.0
v15.3.1-canary.1
v15.3.1-canary.10
v15.3.1-canary.11
v15.3.1-canary.12
v15.3.1-canary.13
v15.3.1-canary.14
v15.3.1-canary.15
v15.3.1-canary.2
v15.3.1-canary.3
v15.3.1-canary.4
v15.3.1-canary.5
v15.3.1-canary.6
v15.3.1-canary.7
v15.3.1-canary.8
v15.3.1-canary.9
v15.4.0
v15.4.0-canary.0
v15.4.0-canary.1
v15.4.0-canary.10
v15.4.0-canary.100
v15.4.0-canary.101
v15.4.0-canary.102
v15.4.0-canary.103
v15.4.0-canary.104
v15.4.0-canary.105
v15.4.0-canary.107
v15.4.0-canary.108
v15.4.0-canary.109
v15.4.0-canary.11
v15.4.0-canary.110
v15.4.0-canary.111
v15.4.0-canary.112
v15.4.0-canary.113
v15.4.0-canary.114
v15.4.0-canary.115
v15.4.0-canary.116
v15.4.0-canary.117
v15.4.0-canary.118
v15.4.0-canary.119
v15.4.0-canary.12
v15.4.0-canary.120
v15.4.0-canary.121
v15.4.0-canary.122
v15.4.0-canary.123
v15.4.0-canary.124
v15.4.0-canary.125
v15.4.0-canary.126
v15.4.0-canary.127
v15.4.0-canary.128
v15.4.0-canary.129
v15.4.0-canary.13
v15.4.0-canary.130
v15.4.0-canary.14
v15.4.0-canary.15
v15.4.0-canary.16
v15.4.0-canary.17
v15.4.0-canary.18
v15.4.0-canary.19
v15.4.0-canary.2
v15.4.0-canary.20
v15.4.0-canary.21
v15.4.0-canary.22
v15.4.0-canary.23
v15.4.0-canary.24
v15.4.0-canary.25
v15.4.0-canary.26
v15.4.0-canary.27
v15.4.0-canary.28
v15.4.0-canary.29
v15.4.0-canary.3
v15.4.0-canary.30
v15.4.0-canary.31
v15.4.0-canary.32
v15.4.0-canary.33
v15.4.0-canary.34
v15.4.0-canary.35
v15.4.0-canary.36
v15.4.0-canary.37
v15.4.0-canary.38
v15.4.0-canary.39
v15.4.0-canary.4
v15.4.0-canary.40
v15.4.0-canary.42
v15.4.0-canary.43
v15.4.0-canary.45
v15.4.0-canary.46
v15.4.0-canary.48
v15.4.0-canary.49
v15.4.0-canary.5
v15.4.0-canary.50
v15.4.0-canary.51
v15.4.0-canary.52
v15.4.0-canary.53
v15.4.0-canary.54
v15.4.0-canary.55
v15.4.0-canary.56
v15.4.0-canary.57
v15.4.0-canary.58
v15.4.0-canary.59
v15.4.0-canary.6
v15.4.0-canary.60
v15.4.0-canary.61
v15.4.0-canary.62
v15.4.0-canary.63
v15.4.0-canary.64
v15.4.0-canary.65
v15.4.0-canary.66
v15.4.0-canary.67
v15.4.0-canary.68
v15.4.0-canary.69
v15.4.0-canary.7
v15.4.0-canary.70
v15.4.0-canary.71
v15.4.0-canary.72
v15.4.0-canary.73
v15.4.0-canary.74
v15.4.0-canary.75
v15.4.0-canary.76
v15.4.0-canary.77
v15.4.0-canary.78
v15.4.0-canary.79
v15.4.0-canary.8
v15.4.0-canary.80
v15.4.0-canary.81
v15.4.0-canary.82
v15.4.0-canary.83
v15.4.0-canary.84
v15.4.0-canary.85
v15.4.0-canary.86
v15.4.0-canary.87
v15.4.0-canary.88
v15.4.0-canary.89
v15.4.0-canary.9
v15.4.0-canary.90
v15.4.0-canary.91
v15.4.0-canary.92
v15.4.0-canary.93
v15.4.0-canary.94
v15.4.0-canary.95
v15.4.0-canary.96
v15.4.0-canary.97
v15.4.0-canary.98
v15.4.0-canary.99
v15.4.1
v15.4.2-canary.0
v15.4.2-canary.1
v15.4.2-canary.10
v15.4.2-canary.11
v15.4.2-canary.12
v15.4.2-canary.13
v15.4.2-canary.14
v15.4.2-canary.15
v15.4.2-canary.16
v15.4.2-canary.17
v15.4.2-canary.18
v15.4.2-canary.19
v15.4.2-canary.2
v15.4.2-canary.20
v15.4.2-canary.21
v15.4.2-canary.22
v15.4.2-canary.23
v15.4.2-canary.24
v15.4.2-canary.25
v15.4.2-canary.26
v15.4.2-canary.27
v15.4.2-canary.28
v15.4.2-canary.29
v15.4.2-canary.3
v15.4.2-canary.30
v15.4.2-canary.31
v15.4.2-canary.32
v15.4.2-canary.33
v15.4.2-canary.34
v15.4.2-canary.35
v15.4.2-canary.36
v15.4.2-canary.37
v15.4.2-canary.38
v15.4.2-canary.39
v15.4.2-canary.4
v15.4.2-canary.40
v15.4.2-canary.41
v15.4.2-canary.42
v15.4.2-canary.43
v15.4.2-canary.44
v15.4.2-canary.45
v15.4.2-canary.46
v15.4.2-canary.47
v15.4.2-canary.48
v15.4.2-canary.49
v15.4.2-canary.5
v15.4.2-canary.50
v15.4.2-canary.51
v15.4.2-canary.52
v15.4.2-canary.53
v15.4.2-canary.54
v15.4.2-canary.55
v15.4.2-canary.56
v15.4.2-canary.6
v15.4.2-canary.7
v15.4.2-canary.8
v15.4.2-canary.9
v15.5.0
v15.5.1
v15.5.10
v15.5.11
v15.5.12
v15.5.13
v15.5.14
v15.5.15
v15.5.16
v15.5.17
v15.5.2
v15.5.3
v15.5.4
v15.5.5
v15.5.6
v15.5.7
v15.5.8
v15.5.9
v16.*
v16.0.0
v16.0.1
v16.0.1-canary.0
v16.0.1-canary.1
v16.0.1-canary.2
v16.0.1-canary.3
v16.0.1-canary.4
v16.0.1-canary.5
v16.0.1-canary.6
v16.0.2-canary.0
v16.0.2-canary.1
v16.0.2-canary.10
v16.0.2-canary.11
v16.0.2-canary.12
v16.0.2-canary.13
v16.0.2-canary.14
v16.0.2-canary.15
v16.0.2-canary.16
v16.0.2-canary.17
v16.0.2-canary.18
v16.0.2-canary.19
v16.0.2-canary.2
v16.0.2-canary.20
v16.0.2-canary.21
v16.0.2-canary.22
v16.0.2-canary.23
v16.0.2-canary.24
v16.0.2-canary.25
v16.0.2-canary.26
v16.0.2-canary.27
v16.0.2-canary.28
v16.0.2-canary.29
v16.0.2-canary.3
v16.0.2-canary.30
v16.0.2-canary.31
v16.0.2-canary.32
v16.0.2-canary.33
v16.0.2-canary.34
v16.0.2-canary.4
v16.0.2-canary.5
v16.0.2-canary.6
v16.0.2-canary.7
v16.0.2-canary.8
v16.0.2-canary.9
v16.1.0
v16.1.0-canary.0
v16.1.0-canary.1
v16.1.0-canary.10
v16.1.0-canary.11
v16.1.0-canary.12
v16.1.0-canary.13
v16.1.0-canary.14
v16.1.0-canary.15
v16.1.0-canary.16
v16.1.0-canary.17
v16.1.0-canary.18
v16.1.0-canary.19
v16.1.0-canary.2
v16.1.0-canary.20
v16.1.0-canary.21
v16.1.0-canary.22
v16.1.0-canary.23
v16.1.0-canary.24
v16.1.0-canary.25
v16.1.0-canary.26
v16.1.0-canary.27
v16.1.0-canary.28
v16.1.0-canary.29
v16.1.0-canary.3
v16.1.0-canary.30
v16.1.0-canary.31
v16.1.0-canary.32
v16.1.0-canary.33
v16.1.0-canary.34
v16.1.0-canary.4
v16.1.0-canary.5
v16.1.0-canary.6
v16.1.0-canary.7
v16.1.0-canary.8
v16.1.0-canary.9
v16.1.1-canary.0
v16.1.1-canary.1
v16.1.1-canary.10
v16.1.1-canary.11
v16.1.1-canary.12
v16.1.1-canary.13
v16.1.1-canary.14
v16.1.1-canary.15
v16.1.1-canary.16
v16.1.1-canary.17
v16.1.1-canary.18
v16.1.1-canary.19
v16.1.1-canary.2
v16.1.1-canary.20
v16.1.1-canary.21
v16.1.1-canary.22
v16.1.1-canary.23
v16.1.1-canary.24
v16.1.1-canary.25
v16.1.1-canary.26
v16.1.1-canary.27
v16.1.1-canary.28
v16.1.1-canary.29
v16.1.1-canary.3
v16.1.1-canary.30
v16.1.1-canary.31
v16.1.1-canary.32
v16.1.1-canary.33
v16.1.1-canary.34
v16.1.1-canary.35
v16.1.1-canary.36
v16.1.1-canary.4
v16.1.1-canary.5
v16.1.1-canary.6
v16.1.1-canary.7
v16.1.1-canary.8
v16.1.1-canary.9
v16.2.0
v16.2.0-canary.0
v16.2.0-canary.1
v16.2.0-canary.10
v16.2.0-canary.100
v16.2.0-canary.101
v16.2.0-canary.102
v16.2.0-canary.103
v16.2.0-canary.104
v16.2.0-canary.11
v16.2.0-canary.12
v16.2.0-canary.13
v16.2.0-canary.14
v16.2.0-canary.15
v16.2.0-canary.16
v16.2.0-canary.17
v16.2.0-canary.18
v16.2.0-canary.19
v16.2.0-canary.2
v16.2.0-canary.20
v16.2.0-canary.21
v16.2.0-canary.22
v16.2.0-canary.23
v16.2.0-canary.24
v16.2.0-canary.25
v16.2.0-canary.26
v16.2.0-canary.27
v16.2.0-canary.28
v16.2.0-canary.29
v16.2.0-canary.3
v16.2.0-canary.30
v16.2.0-canary.31
v16.2.0-canary.32
v16.2.0-canary.33
v16.2.0-canary.34
v16.2.0-canary.35
v16.2.0-canary.36
v16.2.0-canary.37
v16.2.0-canary.38
v16.2.0-canary.39
v16.2.0-canary.4
v16.2.0-canary.40
v16.2.0-canary.41
v16.2.0-canary.42
v16.2.0-canary.43
v16.2.0-canary.44
v16.2.0-canary.45
v16.2.0-canary.46
v16.2.0-canary.47
v16.2.0-canary.48
v16.2.0-canary.49
v16.2.0-canary.5
v16.2.0-canary.50
v16.2.0-canary.51
v16.2.0-canary.52
v16.2.0-canary.53
v16.2.0-canary.54
v16.2.0-canary.55
v16.2.0-canary.56
v16.2.0-canary.57
v16.2.0-canary.58
v16.2.0-canary.59
v16.2.0-canary.6
v16.2.0-canary.60
v16.2.0-canary.61
v16.2.0-canary.62
v16.2.0-canary.63
v16.2.0-canary.64
v16.2.0-canary.65
v16.2.0-canary.66
v16.2.0-canary.67
v16.2.0-canary.68
v16.2.0-canary.69
v16.2.0-canary.7
v16.2.0-canary.70
v16.2.0-canary.71
v16.2.0-canary.72
v16.2.0-canary.73
v16.2.0-canary.74
v16.2.0-canary.75
v16.2.0-canary.76
v16.2.0-canary.77
v16.2.0-canary.78
v16.2.0-canary.79
v16.2.0-canary.8
v16.2.0-canary.80
v16.2.0-canary.81
v16.2.0-canary.82
v16.2.0-canary.83
v16.2.0-canary.84
v16.2.0-canary.85
v16.2.0-canary.86
v16.2.0-canary.87
v16.2.0-canary.88
v16.2.0-canary.89
v16.2.0-canary.9
v16.2.0-canary.90
v16.2.0-canary.91
v16.2.0-canary.92
v16.2.0-canary.93
v16.2.0-canary.94
v16.2.0-canary.95
v16.2.0-canary.96
v16.2.0-canary.97
v16.2.0-canary.98
v16.2.0-canary.99
v16.2.1
v16.2.2
v16.2.3
v16.2.4
v16.2.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45109.json"