Bug 2477190 (CVE-2026-45109) - CVE-2026-45109 next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack
Summary: CVE-2026-45109 next.js: Next.js: Information disclosure via security fix bypa...
Keywords:
Status: NEW
Alias: CVE-2026-45109
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2484264 2484265 2484272 2484225 2484247 2484258 2484259
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-13 18:01 UTC by OSIDB Bzimport
Modified: 2026-07-02 00:05 UTC (History)
16 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:34608 0 None None None 2026-07-02 00:05:00 UTC

Description OSIDB Bzimport 2026-05-13 18:01:46 UTC 
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.
Comment 2 errata-xmlrpc 2026-07-02 00:04:58 UTC 
This issue has been addressed in the following products:

  Streams for Apache Kafka 2.9.4

Via RHSA-2026:34608 https://access.redhat.com/errata/RHSA-2026:34608
Note You need to log in before you can comment on or make changes to this bug.