CVE-2026-45109: Next.js Auth Bypass Vulnerability

CVE-2026-45109 Overview

CVE-2026-45109 is an authorization bypass vulnerability in the Next.js React framework. The flaw exists because the prior fix for CVE-2026-44575 did not extend to middleware.ts when running under Turbopack. Affected versions include Next.js releases from 15.2.0 up to (but not before) 15.5.18 and 16.2.6. Attackers can exploit this issue remotely over the network without authentication or user interaction, leading to confidentiality impact. The vulnerability is tracked under [CWE-288] (Authentication Bypass Using an Alternate Path or Channel). Vercel resolved the issue in Next.js 15.5.18 and 16.2.6.

Critical Impact
Remote, unauthenticated attackers can bypass middleware-enforced authorization in Next.js applications built with Turbopack, exposing protected routes and sensitive data.

Affected Products

Next.js versions 15.2.0 through 15.5.17
Next.js versions 16.0.0 through 16.2.5
Applications using middleware.ts with Turbopack

Discovery Timeline

2026-05-13 - CVE-2026-45109 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-45109

Vulnerability Analysis

Next.js applications commonly rely on middleware.ts to enforce request-level authorization, authentication, redirects, and header rewriting. The framework's middleware is intended to execute before route handlers run, making it the primary control point for access decisions. CVE-2026-45109 breaks that assumption when the application is built using Turbopack, Vercel's Rust-based bundler.

The original fix for CVE-2026-44575 corrected the middleware execution path for the default webpack-based build. However, the patch did not cover the equivalent code path in Turbopack. As a result, middleware checks can be skipped or fail to apply, allowing requests to reach protected handlers without the intended authorization logic running.

Root Cause

The root cause is an incomplete patch. The remediation for CVE-2026-44575 addressed only one of the two middleware execution pipelines in Next.js. Turbopack's independent request-handling pipeline continued to ship the original vulnerable behavior, leaving middleware-enforced checks ineffective. This is an authentication bypass through an alternate path, the defining characteristic of [CWE-288].

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends crafted HTTP requests directly to routes that the application assumes are gated by middleware.ts. Because Turbopack does not enforce the middleware in the affected versions, those routes respond as if the middleware checks passed. Refer to the GitHub Security Advisory GHSA-26hh-7cqf-hhc6 for technical specifics published by the vendor.

Detection Methods for CVE-2026-45109

Indicators of Compromise

Successful HTTP responses to routes that should require authentication, originating from unauthenticated sessions or unexpected IP ranges.
Access log entries showing requests to protected paths without preceding authentication events or session cookies.
Application logs missing the expected middleware execution traces for sensitive routes.

Detection Strategies

Inventory Next.js deployments and identify any application running 15.2.0 through 15.5.17 or 16.0.0 through 16.2.5 with Turbopack enabled.
Compare middleware enforcement telemetry between protected and unprotected route accesses to detect skipped authorization paths.
Replay representative requests to protected endpoints without authentication tokens in a staging environment and confirm whether middleware blocks them.

Monitoring Recommendations

Forward web server and application logs to a centralized analytics platform and alert on anomalous access patterns to routes guarded by middleware.
Monitor for spikes in 200-class responses on endpoints that historically returned 401 or 403 for unauthenticated clients.
Track build configuration changes that enable Turbopack on production Next.js workloads.

How to Mitigate CVE-2026-45109

Immediate Actions Required

Upgrade Next.js to version 15.5.18 or 16.2.6 as released by Vercel.
Audit middleware.ts logic to confirm authorization checks function correctly post-upgrade.
Review access logs since 15.2.0 was deployed for evidence of unauthorized access to protected routes.

Patch Information

Vercel addressed CVE-2026-45109 in Next.js 15.5.18 and 16.2.6. The patch extends the prior CVE-2026-44575 fix to the Turbopack execution path so that middleware.ts is enforced consistently regardless of the bundler. Patch details are available in the GitHub Security Advisory GHSA-26hh-7cqf-hhc6.

Workarounds

Disable Turbopack and revert to the webpack-based build pipeline until the upgrade is applied.
Enforce authorization at the route handler or API layer as defense in depth, rather than relying solely on middleware.
Place an upstream reverse proxy or web application firewall in front of the application to validate authentication before requests reach Next.js.

bash

# Upgrade Next.js to a patched release
npm install next@15.5.18
# or, for the 16.x branch
npm install next@16.2.6

# Verify installed version
npm ls next