p PatchFirst

PatchFirst · Latest vulnerabilities

next 16.2.5: known vulnerabilities · Page 2

Known vulnerabilities affecting next 16.2.5: 21. Compare the fixes below with your installed release.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 21

  1. CVE-2026-45109

    High · CVSS 7.5EPSS 0.6%Fix available

    Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

    Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.

    nextNode.js
    • Update to 16.2.6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →