CVE-2026-45109

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Published

May 13, 2026, 5:11:07 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.60% · Oct 25, 2026

A flaw was found in Next.js. A remote unauthenticated attacker could exploit a bypass in a security fix when using middleware.ts with Turbopack. This vulnerability could lead to the disclosure of sensitive information. next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack This Important information disclosure flaw in Next.js allows a remote unauthenticated attacker to bypass a prior security fix when applications utilize `middleware.ts` with Turbopack. This bypass undermines intended access controls, potentially leading to the exposure of sensitive information in affected Red Hat AMQ and Red Hat Trusted Artifact Signer deployments. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.