Next.js Middleware Turbopack Proxy Bypass Vulnerability

A vulnerability in Next.js middleware processing with Turbopack has been identified, allowing for proxy bypass in App Router applications. This issue arises because the fix for CVE-2026-44575 did not properly address middleware.ts when used with Turbopack. The vulnerability affects Next.js versions 15.2.0 prior to 15.5.18 and 16.0.0 prior to 16.2.6.

Impact

Exploitation of this vulnerability can lead to a proxy bypass, allowing unauthorized access to resources or segments of the application that should be restricted.

Remediation

Users can upgrade to Next.js versions 15.5.18 or 16.2.6 to address this vulnerability.