Skip to Content

← All archived runs

Run: fix-next-middleware-bypass

run.md

Run: fix-next-middleware-bypass

  • lane: bug
  • branch: claude/bump-next-ghsa-26hh-7cqf-hhc6-bc9rao
  • pr: #759

lane/output/notes.md

Bug: fix-next-middleware-bypass

  • observed: every Next app resolved to a version inside the GHSA-26hh-7cqf-hhc6 affected range (next@16.2.3 for web/demo/marketing, next@15.5.15 for docs/help), so a segment-prefetch request could reach an App Router segment without apps/web/proxy.ts running — bypassing the deny-by-default authz gate (getAllowedRoles(pathname) === null → redirect to ROLE_HOME) · expected: no request path reaches a protected segment without the proxy's role check
  • cause: upstream Next.js defect — CVE-2026-45109 (CWE-288, CVSS 7.5). The fix for the earlier bypass (CVE-2026-44575) was incomplete for middleware.ts/proxy.ts under Turbopack in App Router apps; segment-prefetch routes still skipped the middleware. Affected >=15.2.0 <15.5.18 and >=16.0.0 <16.2.6; patched in 15.5.18 and 16.2.6. apps/web builds and runs with --turbo, so it sits squarely on the vulnerable configuration.
  • fix: apps/{web,demo,marketing}/package.json: next16.2.12; apps/{docs,help}/package.json: next15.5.22 (latest patch on each line, both above the advisory's patched floor); pnpm-lock.yaml re-resolved so the only next resolutions left are 16.2.12 and 15.5.22. Existing pin styles kept (exact for web/docs, caret for demo/marketing/help) — raising the caret floors is what stops a fresh install picking a vulnerable version again. No source change: the authz logic in proxy.ts was correct, it was being skipped.
  • changelog: not user-visible — dependency security patch, no behaviour change

Reproduction

No exploit run against a live deployment. Confirmed by version + configuration match, which is what the advisory turns on:

  1. grep '"next"' apps/*/package.json16.2.3, ^16.1.1, ^16.1.1, 15.5.15, ^15.5.7.
  2. pnpm-lock.yaml resolved those to next@16.2.3 and next@15.5.15 — both inside the affected ranges published in GHSA-26hh-7cqf-hhc6.
  3. apps/web runs App Router with Turbopack (next build --turbo, next dev --turbo) and gates every non-public route through apps/web/proxy.ts — the exact configuration the advisory names.

After the bump, grep -E '^ next@' pnpm-lock.yaml returns only next@15.5.22 and next@16.2.12; no resolution inside either affected range remains. The Vercel preview build is the proof the bump is otherwise inert.

Scope note

The report scoped the bump to apps/web (and demo/marketing). apps/docs and apps/help were also inside the affected range (the 15.2.0 → <15.5.18 window) and are included here so the advisory is closed monorepo-wide rather than left half-open for the next dependency scan. Neither Nextra app ships a middleware.ts/proxy.ts, so neither was exploitable — but both are patch bumps within their existing minor, so the cost of including them is nil.

eslint-config-next and @next/eslint-plugin-next are lint tooling, not the runtime, and are not covered by the advisory — left untouched.