CVE-2026-45109

HighCVSS 7.5/10Last modified Nov 4, 2026

Description

Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-288CWE-358

Affected software

VendorProductVersions
vercelnext.js>= 15.2.0, < 15.5.17; >= 16.0.0, < 16.2.6
Red HatStreams for Apache Kafka 2.9.4—
Red HatRed Hat Trusted Artifact Signer 1.3—
Red HatRed Hat Trusted Artifact Signer 1.4—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3—
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3—
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3—
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3—
Red Hatstreams for Apache Kafka 3—

References

Timeline

Published
May 13, 2026
Last modified
Nov 4, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-45116.3A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. Affected is the function exec of the file /src/vanna/legacy. Such CVE-2026-451127.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0CVE-2026-451158.7MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attCVE-2026-451168.7MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profiCVE-2026-451179.8MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database CVE-2026-451189.3MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resCVE-2026-451194.6MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correcCVE-2026-45123.5The reCaptcha by WebDesignBy WordPress plugin before 2.0 does not sanitize or escape the Site Key setting before outputting it in a JavaScriCVE-2026-451205.4MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowinCVE-2026-451214.3MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calenCVE-2026-451224.3MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destinatiCVE-2026-451234.3MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resultin
CVE-2026-45109: High severity, CVSS 7.5 | Vulnix