UpHeron
All vulnerabilities

npm

CVE-2026-45109

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

Severity
High 7.5
Published
11 May 2026
Last changed
10 Sept 2026
Added to UpHeron
14 Oct 2026
Fixed in
15.5.18, 16.2.6
Also known as
GHSA-26hh-7cqf-hhc6
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
Next.jsnpm · osv:npm:next
  • From 15.2.0 before 15.5.18
  • From 16.0.0 before 16.2.6

References