SB2026051193 - Middleware and proxy bypass in App Router applications in Next.js

Description

This security bulletin contains information about 1 vulnerability.

1) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2026-45109)

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to authentication bypass using an alternate path or channel in middleware.ts with Turbopack when handling segment-prefetch routes. A remote attacker can send a specially crafted request to disclose sensitive information.

The issue is an incomplete fix follow-up for the previously reported segment-prefetch route bypass in App Router applications.

Remediation

Install update from vendor's website.

References

• https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6
• https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f