1. Executive summary
The fix for CVE-2026-44575, a middleware and proxy bypass in Next.js App Router applications, does not apply to middleware.ts when the application is built with Turbopack. The incomplete fix is tracked as GHSA-26hh-7cqf-hhc6 and carries a second identifier, CVE-2026-45109, in the GitHub Advisory Database. Affected ranges are >= 15.2.0, < 15.5.18 and >= 16.0.0, < 16.2.6; the patched releases are 15.5.18 and 16.2.6. CVE-2026-44575 is scored CVSS 7.5 HIGH, is not in CISA KEV, and has an EPSS of 2%. No CVE-2026-45109 score appears in NVD, EPSS or CISA KEV data available to Adverse Trace, so the follow-up has no verified severity of its own. For EMEA financial services the exposure is concentrated in internet-facing Next.js applications that enforce authentication or authorisation in middleware rather than in the page's server-side data path.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
The advisory states the mechanism in one line: the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. The original CVE is titled as a middleware and proxy bypass in App Router applications via segment-prefetch routes. The follow-up advisory gives no further mechanism detail and points readers to the original CVE for the underlying flaw.
A separate advisory, GHSA-6gpp-xcg3-4w24, describes a related bypass with a narrower precondition: crafted requests against Next.js applications using App Router, built with Turbopack, and configured with a single entry in config.i18n.locales can bypass middleware or proxy based authentication. That advisory does not state that it covers CVE-2026-44575 or the incomplete fix, and the incomplete-fix advisory does not reference it. Treat the single-locale condition as a property of that advisory's own bypass, not as a confirmed precondition for CVE-2026-44575, until Vercel states the relationship.
What the sources establish:
- Next.js App Router applications built with Turbopack are in scope for the incomplete fix.
- The fix for CVE-2026-44575 does not cover
middleware.tsunder Turbopack, so an application on a release that carries the original fix can still be bypassed through that path. - Affected version ranges are
>= 15.2.0, < 15.5.18and>= 16.0.0, < 16.2.6; patched versions are 15.5.18 and 16.2.6.
What the sources do not state: the exact request construction that triggers the bypass, whether exploitation requires authentication, the impact after a successful bypass beyond the authentication and authorisation control being skipped, and whether the flaw has been exploited in the wild. No exploitation is reported in the sources, and CVE-2026-44575 is not in CISA KEV.
The practical consequence for a defender is that middleware is the security boundary being crossed. Where a Next.js application relies on middleware.ts to gate routes, a bypass places the attacker past that gate and onto whatever the page's server-side data path exposes. The vendor's own workaround for the related advisory is to enforce authorization in the page's server-side data path instead of relying solely on middleware; that guidance appears in GHSA-6gpp-xcg3-4w24 and is the only remediation guidance in the material beyond upgrading.
A third advisory, GHSA-f87g-xv8r-7p7x, covers a different issue: metadata image routes such as opengraph-image and twitter-image ignoring the dynamicParams route segment option in App Router applications built with webpack, allowing requests for dynamic segments excluded from generateStaticParams(). It is a separate advisory with a separate mechanism and is not part of this event.
4. Mitigation & containment
P1 (within 24 hours)
- Inventory internet-facing Next.js applications and record, for each, the Next.js version and whether the build uses Turbopack. Applications in the ranges
>= 15.2.0, < 15.5.18or>= 16.0.0, < 16.2.6built with Turbopack are exposed to the incomplete fix. - For any such application that enforces authentication or authorisation in
middleware.ts, add or confirm an authorisation check in the page's server-side data path so the control does not depend on middleware alone. This is the workaround the vendor gives in GHSA-6gpp-xcg3-4w24. - Where the server-side data path cannot be changed quickly, restrict access to the affected application at the edge (network ACL, identity-aware proxy) until it is upgraded.
P2 (within 72 hours)
- Upgrade to Next.js 15.5.18 or 16.2.6, the patched versions named in the advisory. Confirm after upgrade that the build still uses Turbopack and that the middleware path is exercised in a test that attempts a bypass.
- Review application logs for requests to segment-prefetch routes that reach pages the caller should not have been authorised to load. The sources do not give the request format, so build the review around authorisation outcomes rather than a signature.
P3 (within 7 days)
- Add a build-time check that fails CI when a Next.js dependency resolves below 15.5.18 on the 15.x line or below 16.2.6 on the 16.x line.
- Record which applications depend on middleware for authorisation and schedule migration of those checks into the server-side data path, so a future middleware bypass does not remove the control.
No fixed release is named for CVE-2026-45109 beyond the 15.5.18 and 16.2.6 versions the advisory lists against the affected ranges. No exploitation has been reported, so containment can proceed on patch cadence rather than emergency isolation.
5. Indicators of compromise
No indicators of compromise available in the source material.
The sources describe a request-level bypass but give no request strings, paths, headers, hashes or network indicators. Behavioural indicators follow.
Behavioural indicators
| behaviour | where to observe | confidence |
|---|---|---|
| Requests to segment-prefetch routes that reach pages the caller is not authorised to load | Next.js application and reverse-proxy access logs, correlated with authorisation decisions | medium; the route family is named in the advisory title, the request format is not published |
Successful page loads on routes gated only by middleware.ts in a Turbopack build, from callers without a valid session |
Application logs and the server-side data path | medium; rests on the advisory's statement that the fix does not apply to middleware.ts with Turbopack |
6. Detection
Insufficient indicators to author detection rules.
The sources give no artefact of the bypass itself: no request path, header, query string or payload. A rule built from the CVE identifier, the product name or the advisory title would match reporting about the flaw, not traffic exploiting it.
CVE assessment
1 referenced CVE
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-44575 | 7.5 High | — | 2% | Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router app… |
7. Sources
- GitHub Security Advisories, "Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up" (GHSA-26hh-7cqf-hhc6), https://github.com/advisories/GHSA-26hh-7cqf-hhc6, published 2026-05-11.
- GitHub Advisory Database, "CVE-2026-45109" (affected versions
>= 15.2.0, < 15.5.18,>= 16.0.0, < 16.2.6; patched 15.5.18, 16.2.6), https://github.com/advisories/GHSA-26hh-7cqf-hhc6, published to the database 2026-05-11, published by NVD 2026-05-13, last updated 2026-11-04. - GitHub Security Advisories, "Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale" (GHSA-6gpp-xcg3-4w24), https://github.com/advisories/GHSA-6gpp-xcg3-4w24.
- GitHub Security Advisories, "Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass" (GHSA-f87g-xv8r-7p7x), https://github.com/advisories/GHSA-f87g-xv8r-7p7x.
- Vercel, original advisory for CVE-2026-44575 (GHSA-267c-6grr-h53f), https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f, referenced by the primary item; not retrieved for this advisory.
8. Adverse Trace position
CVE-2026-44575 is CVSS 7.5 HIGH, not in CISA KEV, with an EPSS of 2%; the incomplete fix carries no verified score in NVD, EPSS or CISA KEV data, so Adverse Trace does not assign it one. The client impact is conditional: an internet-facing Next.js application built with Turbopack that enforces authentication or authorisation in middleware.ts is exposed, and one that enforces those checks in the server-side data path is not. No exploitation is reported and no actor is named in any source, so there is no attribution to make. Adverse Trace will track the Vercel advisory for CVE-2026-44575 and any statement linking GHSA-6gpp-xcg3-4w24 to this flaw, and will reissue if a verified score or exploitation report appears for CVE-2026-45109. Clients should confirm their Next.js and Turbopack build inventory against the affected ranges and upgrade to 15.5.18 or 16.2.6.
Published via PulseTrace — Adverse Trace threat intelligence.