UpHeron
All vulnerabilities

npm

CVE-2026-44575

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Severity
High 7.5
Published
11 May 2026
Last changed
10 Sept 2026
Added to UpHeron
14 Oct 2026
Fixed in
15.5.16, 16.2.5
Also known as
GHSA-267c-6grr-h53f
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
Next.jsnpm · osv:npm:next
  • From 15.2.0 before 15.5.16
  • From 16.0.0 before 16.2.5

References