PkgSeer

Vulnerability GHSA-26hh-7cqf-hhc6

High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
5 months ago
May 11, 2026 at 04:21 PM UTC
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
15.2.0 - 15.5.16 and 16.0.0 - 16.2.5
15.2.0 - 15.5.16 and 16.0.0 - 16.2.5

Summary

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

Details

Impact

It was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. Refer to CVE-2026-44575 for further details.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Critical
12 days ago
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
16.0.0 - 16.4.0 GHSA-673q-mjm6-r5xr
16.0.0 - 16.4.0 GHSA-673q-mjm6-r5xr
Medium Risk
12 days ago
next.js cache leak across root param values in nested 'use cache' functions
16.3.0 - 16.3.7 GHSA-h694-7cp9-m8p3
16.3.0 - 16.3.7 GHSA-h694-7cp9-m8p3
Critical
12 days ago
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
10.0.0 - 15.5.27 and 16.0.0 - 16.4.0 GHSA-2464-fhr4-w9xw
10.0.0 - 15.5.27 and 16.0.0 - 16.4.0 GHSA-2464-fhr4-w9xw
High Risk
12 days ago
Next.js: Denial of Service in App Router using Server Actions
13.0.0 - 15.5.27 and 16.0.0 - 16.4.0 GHSA-p3m5-59mp-jv5r
13.0.0 - 15.5.27 and 16.0.0 - 16.4.0 GHSA-p3m5-59mp-jv5r
Medium Risk
27 days ago
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
16.3.0 - 16.3.7 GHSA-3w37-wq28-93x7
16.3.0 - 16.3.7 GHSA-3w37-wq28-93x7
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
5 months ago
May 11, 2026 at 04:21 PM UTC
Fixed (16.2.6)
6 months ago
May 07, 2026 at 07:01 PM UTC
Fixed (15.5.18)
6 months ago
May 07, 2026 at 07:30 PM UTC
Last Modified
6 hours ago
November 04, 2026 at 03:45 AM UTC