Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.

The version of Next.js installed on the remote host is 15.2.0 prior to 15.5.18 or 16.0.0 prior to 16.2.6. It is, therefore, affected by a Middleware / Proxy bypass in App Router applications via segment-prefetch routes, as the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack.

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115734	Next.js 16.0.x < 16.2.6 Middleware Authorization Bypass	Web App Scanning	Component Vulnerability	Version Based	high
115733	Next.js 15.2.0 < 15.5.18 Middleware Authorization Bypass	Web App Scanning	Component Vulnerability	Version Based	high

Detections

Analytics

CVE-2026-45109

high

Tenable Plugins

high

high