highnextCVE-2026-45109
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
Affected versions
>= 15.2.0, < 15.5.18, fixed in 15.5.18>= 16.0.0, < 16.2.6, fixed in 16.2.6
Published 2026-05-11. Last checked 2026-11-01. Read the source advisory