A flaw in Next.js middleware handling when using Turbopack allows an attacker to bypass the intended request preprocessing logic. This can enable the execution of requests that should normally be blocked by authentication or proxy rules, leading to unauthorized data exposure or manipulation within the application. The weakness is classified as Authentication Bypass (CWE‑288, CWE‑358).

Vulnerable versions are Next.js releases from 15.2.0 through 15.5.17 inclusive, and from 16.2.0 through 16.2.5 inclusive. The fix is applied in release 15.5.18 and 16.2.6. Applications built with these versions and configured to use Turbopack in middleware.ts are at risk.

The vulnerability has a CVSS score of 7.5, suggesting a high impact if exploited. The EPSS score is 0.00014 (< 1%), indicating a very low probability of exploitation in the wild. The absence of a KEV listing confirms that there are no publicly known exploits. Despite the low EPSS, the moderate–high severity and the identified authentication bypass (CWE‑288, CWE‑358) recommend a precautionary stance. Attackers would target segment-prefetch routes in App Router applications, and the likely vector is HTTP requests that trigger middleware processing. No special conditions or privilege are required beyond normal web traffic to exploit the bypass.