Security readout for executives and security teams
Plain-English summary
A flaw in the Next.js web framework lets attackers skip security checks that middleware is supposed to enforce, such as login or access gates. Applications built with Turbopack and the App Router are affected. Vercel has released fixed versions (15.5.18 and 16.2.6), and teams running vulnerable versions should update quickly to avoid unauthorized access to protected pages or APIs.
Executive priority
Treat as high priority patch within the next maintenance window, sooner for customer-facing or regulated apps. The bypass targets the exact controls executives rely on for login, tenancy separation, and gated content, and a fix is already available from Vercel and Red Hat.
Technical view
CVE-2026-45109 is a middleware and proxy bypass in Next.js App Router applications using segment-prefetch routes. It stems from an incomplete fix for CVE-2026-44575 that did not cover middleware.ts when running under Turbopack. Crafted prefetch requests can reach downstream handlers without middleware executing, bypassing authentication, authorization, header rewrites, or edge controls. Fixed in 15.5.18 and 16.2.6; CWE-288 (auth bypass) and CWE-358 apply.
Likely exposure
Any Next.js application on 15.2.0 through 15.5.17 or 16.0.0 through 16.2.5 that relies on middleware.ts for auth, tenancy, or routing enforcement, especially when built with Turbopack and using App Router segment prefetching. Exposure is highest for internet-facing SaaS, admin consoles, and multi-tenant apps.
Exploitation context
No CISA KEV listing or confirmed in-the-wild exploitation is cited in the source bundle. CVSS 3.1 base is 7.5 (AV:N/AC:L/PR:N/UI:N/C:H) reflecting network-reachable, unauthenticated bypass with high confidentiality impact. Because the underlying pattern was already disclosed via CVE-2026-44575, weaponized proofs against unpatched apps are plausible.
Researcher notes
This is a regression follow-up to CVE-2026-44575: the prior remediation did not cover middleware.ts under Turbopack, so validation should specifically exercise Turbopack-built apps. CWE-288 and CWE-358 point to authentication bypass by alternate path and improperly implemented security check. Confirm behavior across both 15.x and 16.x branches, and verify edge runtime vs. Node runtime middleware since prefetch routing paths can differ.
Mitigation direction
- Upgrade Next.js to 15.5.18 or 16.2.6 (or later) across all environments.
- Apply Red Hat errata RHSA-2026:37272 and RHSA-2026:34608 where OpenShift or RHEL Next.js packages are used.
- For unpatched apps, enforce authentication and authorization in route handlers, not solely middleware.
- Restrict or disable App Router segment prefetching on sensitive routes until patched.
- Review CDN and edge proxy rules for defense-in-depth on protected paths.
Validation and detection
- Inventory Next.js versions in production, CI images, and container base layers against fixed releases.
- Confirm Turbopack build usage and identify apps relying on middleware.ts for access control.
- Replay prefetch-style requests against protected routes and verify middleware executes in logs.
- Check dependency manifests (package.json, lockfiles) in monorepos and forks for pinned vulnerable ranges.
- Track Red Hat VEX (cve-2026-45109.json) and GHSA-26hh-7cqf-hhc6 for status changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-288: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-358: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-45109 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6GitHub_MCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-05-13T18:01:23.402Z: Reported to Red Hat.
- 2026-05-13T17:11:07.275Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6CVE reference, GitHub_M · x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-45109CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2477190CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45109.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:37272CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34608CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improperly Implemented Security Check for Standard
Improperly Implemented Security Check for Standard represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.