13 Next.js security advisories: which ones break middleware auth and the exact versions that fix them
Four of the 13 Next.js advisories published in May 2026 let attackers reach protected pages without passing middleware. Patching to 16.2.5 does not close all of them, and the reason is Turbopack.
