CVE-2026-45109 — Vulnerability intelligence

vercel — next.js

Published: 2026-05-13T17:11:07.275Z

CVSS

7.5

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.

Sources

• CVE-2026-45109
• Original advisory
• Original advisory
• Original advisory
• Vendor Advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• CVE-2026-45109