CVE-2026-45109

Executive Summary

CVE-2026-45109 is a high-severity vulnerability in Vercel's Next.js framework, affecting versions 15.2.0 through 15.5.17 and 16.0.0 through 16.2.5. The issue arises from an incomplete fix for a previous vulnerability (CVE-2026-44575), where the security patch was not properly applied to middleware.ts files when the application is built or run using Turbopack. This oversight allows attackers to bypass security controls implemented in middleware, potentially leading to unauthorized access to protected routes or resources. The vulnerability has a CVSS score of 7.5, indicating high severity, and is classified under CWE-20 (Improper Input Validation). Patches are available in versions 15.5.18 and 16.2.6.

Supply Chain & Package Security

This vulnerability affects the Next.js npm package, a critical component in the React ecosystem. Organizations using Next.js should immediately audit their dependency trees for affected versions. The incomplete patch highlights the importance of thorough regression testing across all build tools (e.g., Turbopack vs. Webpack). Supply chain risk is elevated because Next.js is widely used in production environments, and middleware is a common pattern for implementing authentication, authorization, and request filtering.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No direct data disclosure.
• Integrity (I): High (H) – Attackers can bypass middleware security controls, potentially modifying application behavior or accessing protected resources.
• Availability (A): None (N) – No direct denial-of-service impact.

Threat Level: High. The vulnerability allows bypassing critical security logic in middleware, which is often used for authentication, rate limiting, and input validation. With no privileges required and low attack complexity, this is a prime target for automated exploitation.

Deep Dive & Mechanics

The root cause is a failure in the Turbopack bundler to correctly apply the security fix for CVE-2026-44575 to middleware.ts files. The original vulnerability (CVE-2026-44575) likely involved improper handling of request data or route matching in middleware. The fix for that CVE was implemented in a way that worked with the default Webpack bundler but was not ported to the Turbopack code path.

Turbopack is an incremental bundler developed by Vercel for faster development builds. When Next.js is configured to use Turbopack (e.g., via next dev --turbo or production builds with Turbopack enabled), the middleware compilation step does not include the security patch. This means that middleware functions that were intended to filter or block malicious requests are effectively disabled or incomplete when Turbopack is used.

Attackers can craft HTTP requests that would normally be intercepted and blocked by middleware (e.g., requests to admin panels, API endpoints with missing authentication, or paths with path traversal attempts) and have them processed without the middleware's security checks.

Vulnerable vs. Patched Code

The exact code changes are not publicly disclosed, but the patch likely involves modifications to the Turbopack integration code in Next.js. The vulnerable code path would be in the Turbopack plugin or loader that handles middleware.ts compilation. The patched version ensures that the same security logic applied to Webpack builds is also applied to Turbopack builds.

Vulnerable (Conceptual):

// In Turbopack middleware compilation (vulnerable)
// The security fix from CVE-2026-44575 is missing
function compileMiddleware(filePath) {
  // ... compilation logic without the security patch
  return compiledMiddleware;
}

Patched (Conceptual):

// In Turbopack middleware compilation (patched)
// The security fix from CVE-2026-44575 is now included
function compileMiddleware(filePath) {
  // ... compilation logic WITH the security patch applied
  return compiledMiddleware;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Next.js application using middleware.ts with security controls (e.g., authentication check, IP filtering, path validation).
• The application is built or run with Turbopack enabled (e.g., next dev --turbo or production build with Turbopack).
• Vulnerable version: 15.2.0 to 15.5.17 or 16.0.0 to 16.2.5.

Exploitation Steps:

1. Identify the target Next.js application and confirm it uses Turbopack (e.g., by checking response headers or build output).
2. Determine the middleware logic. For example, if middleware blocks access to /admin for unauthenticated users:

   // middleware.ts
   import { NextResponse } from 'next/server';
   export function middleware(request) {
     if (request.nextUrl.pathname.startsWith('/admin') && !request.cookies.get('auth_token')) {
       return NextResponse.redirect('/login');
     }
   }
   

3. Send a request to a protected route (e.g., GET /admin) without authentication.
4. If the vulnerability is present, the middleware will not execute, and the request will be processed as if the middleware does not exist. The attacker gains access to the protected resource.

Proof of Concept (PoC) Request:

curl -v http://target.com/admin

Expected vulnerable response: The admin page is served without authentication.

Blue Team

Detection:

• Monitor for requests to protected routes that bypass middleware. Look for patterns where middleware logs are missing for requests that should have triggered them.
• Check server logs for unusual access to sensitive endpoints (e.g., /admin, /api/private, /config).
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Hunting:

• Search for Next.js applications in your environment that use Turbopack. Check the next.config.js or package.json for Turbopack-related settings.
• Verify the Next.js version: npm list next or check node_modules/next/package.json.
• If using a containerized deployment, inspect the build logs for references to Turbopack.

Mitigation:

• Immediately upgrade to Next.js 15.5.18 or 16.2.6.
• If immediate upgrade is not possible, disable Turbopack by removing --turbo from dev commands and ensuring production builds use Webpack (default).
• Implement additional security controls at the reverse proxy or WAF level to compensate for the missing middleware checks.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to protected routes that should have been blocked by middleware.
  • Absence of middleware-specific headers or cookies in responses.
• Host:
  • Next.js version in package.json or node_modules/next/package.json is between 15.2.0 and 15.5.17 or 16.0.0 and 16.2.5.
  • Build artifacts or logs referencing Turbopack (e.g., [turbo] in build output).
• File:
  • Presence of .next/turbo directory in the build output.
  • Configuration files (next.config.js) with experimental.turbopack or similar settings.

Detection Engineering

YARA Rule

rule Detect_Vulnerable_NextJS_Middleware_Turbopack {
    meta:
        description = "Detects vulnerable Next.js versions affected by CVE-2026-45109"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-45109"
        severity = "high"
    strings:
        $version_15 = /"version":\s*"15\.(2\.[0-9]|3\.[0-9]|4\.[0-9]|5\.[0-9]|5\.1[0-7])"/
        $version_16 = /"version":\s*"16\.(0\.[0-9]|1\.[0-9]|2\.[0-5])"/
        $turbopack = /turbopack/i
    condition:
        ($version_15 or $version_16) and $turbopack
}

Sigma Rule

title: Next.js Middleware Bypass via Turbopack (CVE-2026-45109)
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2026-45109 where middleware security controls are bypassed due to incomplete patch in Turbopack.
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: nextjs
detection:
    selection:
        c-uri|startswith:
            - '/admin'
            - '/api/private'
            - '/config'
            - '/.env'
        sc-status: 200
    filter:
        c-uri|contains: '/_next/static'
    condition: selection and not filter
falsepositives:
    - Legitimate access to unprotected routes
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-45109 - Next.js Middleware Bypass via Turbopack";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/admin";
    http_uri;
    pcre:"/^\/admin(?:\/|$)/";
    sid:1000001;
    rev:1;
    reference:cve,2026-45109;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Next.js: Update to version 15.5.18 or 16.2.6 immediately.

   npm install next@15.5.18
   # or
   npm install next@16.2.6
   

2. Disable Turbopack: If upgrade is delayed, disable Turbopack by removing --turbo from development commands and ensuring production builds use Webpack (default).
3. Verify Patch: After upgrade, confirm that middleware functions correctly by testing protected routes.

Long-term Measures:

• Implement automated dependency scanning to detect vulnerable versions.
• Add regression tests that verify middleware behavior across different build tools (Webpack and Turbopack).
• Monitor Vercel security advisories for related patches.

Workarounds:

• If upgrading is not possible, implement middleware-like security controls at the reverse proxy (e.g., Nginx, Apache) or use a Web Application Firewall (WAF) to block access to sensitive routes.

Valters IT
Securing the digital frontier, one CVE at a time.