Next.js versions >=15.2.0 <15.5.18 and >=16.0.0 <16.2.6 contain a vulnerability (CWE-288, CWE-358) where a security fix addressing CVE-2026-44575 does not apply correctly to middleware.ts when used with Turbopack. This flaw allows remote unauthenticated attackers to bypass intended access controls, potentially exposing sensitive information. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low complexity, no privileges required, and no user interaction. The issue is fixed in Next.js versions 15.5.18 and 16.2.6. Red Hat's advisory confirms the impact on their products that use Next.js and notes that mitigation options are either unavailable or do not meet their criteria for ease of use and deployment.

The vulnerability enables remote unauthenticated attackers to bypass a prior security fix in Next.js middleware when using Turbopack, leading to potential disclosure of sensitive information. There is no impact on integrity or availability. The flaw undermines access control mechanisms, which could expose sensitive data in affected deployments such as Red Hat AMQ and Red Hat Trusted Artifact Signer.

A fix is available in Next.js versions 15.5.18 and 16.2.6. Users should upgrade to these or later versions to remediate the vulnerability. According to the Red Hat advisory, no effective mitigation other than upgrading is currently available or meets their criteria for deployment and stability. Monitoring for vendor updates and applying official patches promptly is recommended.