Threats tagged 'ghsa-26hh-7cqf-hhc6'

A vulnerability in Next.js App Router applications allows middleware or proxy bypass via segment-prefetch routes. This issue is an incomplete fix of CVE-2026-44575, specifically affecting middleware.ts when used with Turbopack. The vulnerability can lead to information disclosure due to middleware bypass. It affects Next.js versions from 15.2.0 up to but not including 15.5.18, and from 16.0.0 up to but not including 16.2.6. A patch is available in versions 15.5.18 and 16.2.6.