Description
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.
Affected products
vercel: next.js
References10
- github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hh… Vendor Advisory
- github.com/vercel/next.js/releases/tag/v15.5.18
- github.com/vercel/next.js/releases/tag/v16.2.6
- github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h5…
- vercel.com/changelog/next-js-may-2026-security-release
- access.redhat.com/errata/RHSA-2026:34608
- access.redhat.com/errata/RHSA-2026:37272
- access.redhat.com/errata/RHSA-2026:40974
- access.redhat.com/errata/RHSA-2026:54435
- access.redhat.com/security/cve/CVE-2026-45109
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS — exploit probability
- 1% percentile: 59 · as of 14 November 2026
- CWE
- CWE-288CWE-358
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.