fix-next-middleware-bypassrun.mdlane/output/notes.mdnext@16.2.3 for web/demo/marketing, next@15.5.15 for docs/help), so a segment-prefetch
request could reach an App Router segment without apps/web/proxy.ts running — bypassing the
deny-by-default authz gate (getAllowedRoles(pathname) === null → redirect to ROLE_HOME)
· expected: no request path reaches a protected segment without the proxy's role checkmiddleware.ts/proxy.ts under Turbopack in App
Router apps; segment-prefetch routes still skipped the middleware. Affected >=15.2.0 <15.5.18
and >=16.0.0 <16.2.6; patched in 15.5.18 and 16.2.6. apps/web builds and runs with
--turbo, so it sits squarely on the vulnerable configuration.apps/{web,demo,marketing}/package.json: next → 16.2.12; apps/{docs,help}/package.json:
next → 15.5.22 (latest patch on each line, both above the advisory's patched floor);
pnpm-lock.yaml re-resolved so the only next resolutions left are 16.2.12 and 15.5.22.
Existing pin styles kept (exact for web/docs, caret for demo/marketing/help) — raising the caret
floors is what stops a fresh install picking a vulnerable version again. No source change: the
authz logic in proxy.ts was correct, it was being skipped.No exploit run against a live deployment. Confirmed by version + configuration match, which is what the advisory turns on:
grep '"next"' apps/*/package.json → 16.2.3, ^16.1.1, ^16.1.1, 15.5.15, ^15.5.7.pnpm-lock.yaml resolved those to next@16.2.3 and next@15.5.15 — both inside the affected
ranges published in GHSA-26hh-7cqf-hhc6.apps/web runs App Router with Turbopack (next build --turbo, next dev --turbo) and gates
every non-public route through apps/web/proxy.ts — the exact configuration the advisory names.After the bump, grep -E '^ next@' pnpm-lock.yaml returns only next@15.5.22 and next@16.2.12;
no resolution inside either affected range remains. The Vercel preview build is the proof the bump
is otherwise inert.
The report scoped the bump to apps/web (and demo/marketing). apps/docs and apps/help were
also inside the affected range (the 15.2.0 → <15.5.18 window) and are included here so the
advisory is closed monorepo-wide rather than left half-open for the next dependency scan. Neither
Nextra app ships a middleware.ts/proxy.ts, so neither was exploitable — but both are patch
bumps within their existing minor, so the cost of including them is nil.
eslint-config-next and @next/eslint-plugin-next are lint tooling, not the runtime, and are not
covered by the advisory — left untouched.