{"id":"EUVD-2026-30085","enisaUuid":"abdb66c6-d804-305c-bb39-fd0eb2f6250f","description":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.","datePublished":"May 13, 2026, 5:11:07 PM","dateUpdated":"Aug 13, 2026, 12:04:29 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6\n","aliases":"CVE-2026-45109\nGHSA-26hh-7cqf-hhc6\n","assigner":"GitHub_M","epss":0.6,"enisaIdProduct":[{"id":"963833c9-1d4e-3cf0-a463-f4c52340692d","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"15.2.0, \u003c 15.5.17"},{"id":"e4d1bfc7-74d5-3f82-977d-29b348516705","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"16.0.0, \u003c 16.2.6"}],"enisaIdVendor":[{"id":"a99672c6-e327-32fd-8e7a-ded7d550a3e3","vendor":{"name":"vercel"}}],"enisaIdVulnerability":[{"id":"192a47cf-cd45-3942-b86c-c4cf36978baf","vulnerability":{"id":"GHSA-26hh-7cqf-hhc6","description":"Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up","datePublished":"May 11, 2026, 4:21:19 PM","dateUpdated":"May 14, 2026, 8:39:01 PM","baseScore":0.0,"references":"https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f\nhttps://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45109\nhttps://github.com/vercel/next.js\nhttps://github.com/vercel/next.js/releases/tag/v15.5.18\nhttps://github.com/vercel/next.js/releases/tag/v16.2.6\n","enisa_id":"EUVD-2026-30085\n","aliases":"CVE-2026-45109\nGHSA-26hh-7cqf-hhc6\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"71002e59-9e13-30a7-b9ea-6d978069814d","vulnerability":{"id":"CVE-2026-45109","description":"Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.","datePublished":"May 13, 2026, 5:11:07 PM","dateUpdated":"Aug 13, 2026, 12:04:29 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6\n","enisa_id":"EUVD-2026-30085\n","assigner":"GitHub_M","epss":0.6,"dataProcessed":"Oct 28, 2026, 7:17:09 AM","vulnerabilityProduct":[{"id":"5f5e2602-9377-36bf-8a58-6cd08ff727f8","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"16.0.0, \u003c 16.2.6"},{"id":"827d9ced-69b9-313c-a0be-9a5aa4b9552b","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"15.2.0, \u003c 15.5.17"}],"vulnerabilityVendor":[{"id":"ca9d14d9-5b5e-367d-aa71-268170460ba9","vendor":{"name":"vercel"}}]}}],"enisaIdAdvisory":[{"id":"09de55c5-2314-3b8a-9ead-05ac300ccf13","advisory":{"id":"RHSA-2026:54435","description":"Red Hat Security Advisory: Streams for Apache Kafka 3.2.1 release and security update","summary":"Streams for Apache Kafka 3.2.1 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.","datePublished":"Aug 12, 2026, 7:35:14 PM","dateUpdated":"Oct 23, 2026, 7:36:38 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:54435\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54435.json\n","aliases":"CVE-2026-6860\nCVE-2026-10051\nCVE-2026-15075\nCVE-2026-15076\nCVE-2026-16308\nCVE-2026-27145\nCVE-2026-32283\nCVE-2026-33811\nCVE-2026-34478\nCVE-2026-34480\nCVE-2026-34481\nCVE-2026-35554\nCVE-2026-39821\nCVE-2026-39852\nCVE-2026-40983\nCVE-2026-40984\nCVE-2026-42504\nCVE-2026-42578\nCVE-2026-42579\nCVE-2026-42581\nCVE-2026-42583\nCVE-2026-42584\nCVE-2026-42587\nCVE-2026-44249\nCVE-2026-44573\nCVE-2026-44574\nCVE-2026-44575\nCVE-2026-44577\nCVE-2026-44578\nCVE-2026-44579\nCVE-2026-44893\nCVE-2026-45109\nCVE-2026-45416\nCVE-2026-45674\nCVE-2026-47691\nCVE-2026-48043\nCVE-2026-48059\nCVE-2026-49978\nCVE-2026-50193\nCVE-2026-50559\nCVE-2026-54512\nCVE-2026-54513\nCVE-2026-55225\nCVE-2026-55831\nCVE-2026-55833\nCVE-2026-56745\nCVE-2026-56746\nCVE-2026-56819\nCVE-2026-59869\nCVE-2026-59899\nCVE-2026-59901\nCVE-2026-64641\nCVE-2026-64644\nCVE-2026-64645\nCVE-2026-64646\nCVE-2026-64648\nCVE-2026-64649\nCVE-2026-69153\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"54bf2300-38b2-3b62-b9bb-280d0cd5af56","product":{"name":"Streams for Apache Kafka 3.2.1","vendor":{"name":"Red Hat"}}}]}},{"id":"2e8762e5-c095-37c3-889d-138dfff21dd7","advisory":{"id":"RHSA-2026:34608","description":"Red Hat Security Advisory: Streams for Apache Kafka 2.9.4 release and security update","summary":"Streams for Apache Kafka 2.9.4 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.","datePublished":"Jul 2, 2026, 12:03:15 AM","dateUpdated":"Oct 23, 2026, 11:03:22 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:34608\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34608.json\n","aliases":"CVE-2024-29371\nCVE-2025-13465\nCVE-2025-58056\nCVE-2026-1002\nCVE-2026-4800\nCVE-2026-6860\nCVE-2026-23864\nCVE-2026-24281\nCVE-2026-24308\nCVE-2026-27980\nCVE-2026-33870\nCVE-2026-33871\nCVE-2026-34480\nCVE-2026-39852\nCVE-2026-41240\nCVE-2026-42044\nCVE-2026-42583\nCVE-2026-42587\nCVE-2026-44249\nCVE-2026-44573\nCVE-2026-44574\nCVE-2026-44575\nCVE-2026-44577\nCVE-2026-44578\nCVE-2026-44579\nCVE-2026-44893\nCVE-2026-45109\nCVE-2026-45416\nCVE-2026-45674\nCVE-2026-47691\nCVE-2026-48043\nCVE-2026-48059\nCVE-2026-50010\nCVE-2026-50559\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"852b98d0-e6bd-3554-9c87-471499b39e25","product":{"name":"Streams for Apache Kafka 2.9.4","vendor":{"name":"Red Hat"}}}]}},{"id":"457388e7-24a1-3877-9a39-fcbed62300f4","advisory":{"id":"RHSA-2026:37272","description":"Red Hat Security Advisory: RHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release","summary":"The 1.4.2 release of Red Hat Trusted Artifact Signer OpenShift Operator.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4","datePublished":"Jul 9, 2026, 11:43:10 AM","dateUpdated":"Oct 23, 2026, 5:31:45 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:37272\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37272.json\n","aliases":"CVE-2025-71319\nCVE-2026-39828\nCVE-2026-39829\nCVE-2026-39830\nCVE-2026-39835\nCVE-2026-42151\nCVE-2026-42570\nCVE-2026-44573\nCVE-2026-44574\nCVE-2026-44575\nCVE-2026-44577\nCVE-2026-44578\nCVE-2026-44579\nCVE-2026-45109\nCVE-2026-45736\nCVE-2026-48779\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"0d3ebed6-4497-311a-bbe7-d728076136ba","product":{"name":"registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:c0dfe2abf8d55740eefbaa647de617d1f796390111fae05919bf77897763977b_amd64","vendor":{"name":"Red Hat"}}},{"id":"28bb2d8d-09c5-39f2-ae8f-3b3e2ef8f57f","product":{"name":"registry.redhat.io/rhtas/fulcio-rhel9@sha256:9ba4d183d46315edb1a059e55267f30ab66069324cfc3a1a205fdabe45641e71_amd64","vendor":{"name":"Red Hat"}}},{"id":"4966c6f7-9010-3c7e-b4f5-fb49a2db40cc","product":{"name":"registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b5736b9f843573e1820b25da162b537b5f324d437c78a79c54f5258fa2204521_amd64","vendor":{"name":"Red Hat"}}},{"id":"61a8cc47-ddd1-3e44-988f-a5ce59ea09b0","product":{"name":"registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:613398e5394371bac97d05c04d97b163c5048a8095ff8ff8bc510a24e46092d6_amd64","vendor":{"name":"Red Hat"}}},{"id":"7e1dc536-50ee-3dcb-a7e0-a25085cda510","product":{"name":"registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:fd4c05777a37475158316b694d4319c0a8ea0e39838306ee73523ec37fd3f3fa_amd64","vendor":{"name":"Red Hat"}}},{"id":"8ebdfa58-aa35-3c2f-af46-81e928b4ddf7","product":{"name":"registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:6cac09fcce3938f4e08e0dc5960ca5159bd4c36d238e1e49037c977c62dde85d_amd64","vendor":{"name":"Red Hat"}}},{"id":"90a7416b-d741-398a-b2aa-0f2de4eb85c3","product":{"name":"registry.redhat.io/rhtas/rekor-server-rhel9@sha256:938ca7e6d7fa3862825a86f142be9c6a7b5da1f7dfc6393bff5f77e24613bf67_amd64","vendor":{"name":"Red Hat"}}},{"id":"a3b1dbd0-0004-358b-b6d0-62815640fd9b","product":{"name":"registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:5c3552503bc698f229f835e3686462b75a3af15575edfa1081880fc945f2d8cf_amd64","vendor":{"name":"Red Hat"}}},{"id":"a4c33a54-9547-3a22-8e0c-5d2540d3f1b4","product":{"name":"Red Hat Trusted Artifact Signer 1.4","vendor":{"name":"Red Hat"}}},{"id":"bce53b05-b1e1-38a0-a40c-e5b887be8823","product":{"name":"registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:428e9da9c20b26a5ba88ec84f1be212ce0474f81c2fd56ac062e3948eb23070d_amd64","vendor":{"name":"Red Hat"}}},{"id":"d87264a3-249e-321c-b036-020c31b5012d","product":{"name":"registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:c34be5197926b29fc858ca4295773feb24d7a812691d4c88a70f3be3bbe49ff9_amd64","vendor":{"name":"Red Hat"}}}]}},{"id":"e40ec995-8630-392e-a873-1564f0ef985c","advisory":{"id":"RHSA-2026:40974","description":"Red Hat Security Advisory: RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release","summary":"The 1.3.6 release of Red Hat Trusted Artifact Signer OpenShift Operator.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3","datePublished":"Jul 16, 2026, 11:19:42 AM","dateUpdated":"Oct 23, 2026, 5:31:48 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:40974\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40974.json\n","aliases":"CVE-2026-39828\nCVE-2026-39829\nCVE-2026-39830\nCVE-2026-39831\nCVE-2026-39835\nCVE-2026-42151\nCVE-2026-42154\nCVE-2026-44573\nCVE-2026-44574\nCVE-2026-44575\nCVE-2026-44577\nCVE-2026-44578\nCVE-2026-44579\nCVE-2026-45109\nCVE-2026-46597\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"0e7addbb-24c7-3d81-95dd-a3b7077160d4","product":{"name":"Red Hat Trusted Artifact Signer 1.3","vendor":{"name":"Red Hat"}}},{"id":"1ceb13d3-4472-3de5-a188-885f79eb1434","product":{"name":"registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:28a5270a23b171cdaaca9adf3d6fc24db410a01fc1acdbd87b666e61215f5b3c_amd64","vendor":{"name":"Red Hat"}}},{"id":"213395f5-6df9-3e89-a9e0-3ec7c81a94d7","product":{"name":"registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:b713256acad58c623920da912e3442803a4c6d2f7354d532ff3f772740fe86ab_amd64","vendor":{"name":"Red Hat"}}},{"id":"24ffc8b8-312d-333b-b2f8-b7a716be81aa","product":{"name":"registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:8ee5d92df659073a13d9aa71e3e5fedac97e0c555a865ebf3697591ea6a38c59_amd64","vendor":{"name":"Red Hat"}}},{"id":"48d42be0-c4cc-30a8-9528-4428f136c725","product":{"name":"registry.redhat.io/rhtas/fulcio-rhel9@sha256:ddeaf6343db4caaa9e33c6acac0ac2025b807780570bcbfaa412d0bf89b8cb9b_amd64","vendor":{"name":"Red Hat"}}},{"id":"67ba3c06-a9bd-3497-8cc5-bd199dffbc52","product":{"name":"registry.redhat.io/rhtas/rekor-server-rhel9@sha256:03a020d623cc6115237fee9579500f7b047789857df04bdc7c6c14cb37e6de7b_amd64","vendor":{"name":"Red Hat"}}},{"id":"a6ad233a-e304-36f0-8d81-07b89edc2529","product":{"name":"registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a480b790358eaf214628d5e9d94b9a05614b76540e35ccca33cff3319c7ae6a0_amd64","vendor":{"name":"Red Hat"}}},{"id":"b40d8161-9fef-3ba3-826f-b43c04e9fc91","product":{"name":"registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:716df3ddc8bbf4a5c25dae7dbbd1bebba91508df2bb4cc2cc1979c5e5d97923e_amd64","vendor":{"name":"Red Hat"}}},{"id":"bd73aa3f-d3d5-309f-a57f-5e39945ae84a","product":{"name":"registry.redhat.io/rhtas/trillian-database-rhel9@sha256:cbb7c79ec6053cea1269941dd40d55efb8f6437039d6cbd6a9b4ef55b6393278_amd64","vendor":{"name":"Red Hat"}}},{"id":"e3e3aa23-3b2a-3a8c-8d33-5a0395491168","product":{"name":"registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:e4d9e12f8a0af0fa79ef79d0f3b938a7b1d0049baaf305168fb70a8a9922694e_amd64","vendor":{"name":"Red Hat"}}},{"id":"ecbc131c-0c43-3eb0-a4e2-8c9c8bcebb00","product":{"name":"registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:cc908b30beddb8c8857888ab0a7b2c84990749b7bfd326ccbd06606ae93427d2_amd64","vendor":{"name":"Red Hat"}}}]}}]}