{"id":"CVE-2026-64642","aliases":["GHSA-6gpp-xcg3-4w24"],"title":"Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale","summary":"Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale","severity":"high","cwe":["CWE-285"],"vendor":"next","product":"next","ecosystem":"npm","affected":["next >= 16.0.0, < 16.2.11"],"patched":["next 16.2.11"],"published":"2026-07-22","updated":"2026-07-22","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-6gpp-xcg3-4w24","references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24"},{"url":"https://github.com/vercel/next.js/pull/96014"},{"url":"https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151"},{"url":"https://github.com/vercel/next.js/releases/tag/v16.2.11"},{"url":"https://github.com/advisories/GHSA-6gpp-xcg3-4w24"}],"tags":["ghsa","npm"],"ingestedAt":"2026-07-22T23:07:32.286Z","epss":0.01164,"epssPercentile":0.6587,"slug":"CVE-2026-64642","body":"## Overview\n\n## Impact\n\nCrafted requests targeting Next.js applications using App Router built with Turbopack and a **single** entry in `config.i18n.locales` can bypass middleware/proxy based authentication.\n\n## Workarounds\n\nIf you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.\n\n## Affected packages\n\n- `next >= 16.0.0, < 16.2.11`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `next 16.2.11`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}