GHSA-26hh-7cqf-hhc6
High · 7.5CVSS
7.5
EPSS
—
Published
May 11, 2026
CISA due date
—
The record
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | next | 15.2.0 | 15.5.18 |
| npm | next | 16.0.0 | 16.2.6 |
Related vulnerabilities
- CVE-2026-45109 Next.js is a React framework for building full-stack web applications. Same vulnerability
- CVE-2026-44582 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44581 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44580 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44579 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44578 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44576 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44577 Next.js is a React framework for building full-stack web applications. Also affects next