Next.js: pages protected only by middleware can be opened without logging in
Identifiers: CVE-2026-44575 · GHSA-267c-6grr-h53f · CVE-2026-45109 · GHSA-26hh-7cqf-hhc6 · CVSS 3.1 7.5 (scored by GitHub)
What it is
Many apps check that the visitor is logged in only in middleware.ts (proxy.ts). With the App Router, crafted .rsc or segment-prefetch URLs reach the same protected page without matching the middleware's rule, so the check never runs and the page's data comes back. The first fix missed middleware.ts under Turbopack; a second advisory closed it.
Who is affected
Versions inside these ranges are affected. The fixed versions are the ones to move to.
| Registry | Package | Affected | Move to |
|---|---|---|---|
| npm | next | >= 15.2.0, < 15.5.18 >= 16.0.0, < 16.2.6 | 15.5.18, 16.2.6 |
How to check
Run one of these in your project's folder; the first two download the CLI and check its SHA-256 first:
d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" depsdocker run --rm -v "$PWD:/src" -w /src alpine:3.20 sh -c 'apk add -q curl && d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps'xsec depsOr look up next in your lockfile and compare the version with the ranges above.
How to fix it
Upgrade next to 15.5.18 or 16.2.6 at least (better, the newest patch of your line). And check authorization again where the data is read: in the page, route handler or server action, not only in middleware.
Sources
This list is curated by hand and kept short on purpose: it is not every known vulnerability, and a clean xsec deps does not mean no dependency has a flaw. Use your package manager's audit (npm audit, pip-audit, bundle audit) or Dependabot for the rest.