CVE-2026-45109

A flaw was found in Next.js. A remote unauthenticated attacker could exploit a bypass in a security fix when using middleware.ts with Turbopack. This vulnerability could lead to the disclosure of sensitive information.

This Important information disclosure flaw in Next.js allows a remote unauthenticated attacker to bypass a prior security fix when applications utilize middleware.ts with Turbopack. This bypass undermines intended access controls, potentially leading to the exposure of sensitive information in affected Red Hat AMQ and Red Hat Trusted Artifact Signer deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.