PT-2026-39754 · Vercel · Turbopack+1

Tim Neutkens · Published 2026-05-11 · Updated 2026-05-15 · CVE-2026-45109

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Next.js versions 15.2.0 through 15.5.17 Next.js versions 16.0.0 through 16.2.5

Description A flaw exists where a previous security fix was not correctly applied to middleware.ts when used in conjunction with Turbopack, a high-performance incremental bundler for JavaScript and TypeScript.

Recommendations Update to version 15.5.18. Update to version 16.2.6.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-45109

GHSA-26HH-7CQF-HHC6

Affected Products

Next.Js

Turbopack

References · 10

• https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45109 · Security Note
• https://osv.dev/vulnerability/GHSA-26hh-7cqf-hhc6 · Vendor Advisory
• https://github.com/vercel/next.js/releases/tag/v16.2.6 · Note
• https://github.com/vercel/next.js/releases/tag/v15.5.18 · Note
• https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f · Note
• https://github.com/vercel/next.js · Note
• https://twitter.com/cybrsecpath/status/2055258546292547737 · Twitter Post
• https://twitter.com/UpwindMDR/status/2053879564124778970 · Twitter Post
• https://twitter.com/SelvaKtm2/status/2055268430048342420 · Twitter Post