CVE-2026-64642High▾ TwilightNext.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 28.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
1.3%
Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication.
If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.
next >= 16.0.0, < 16.2.11Upgrade to a patched release:
next 16.2.11Connected by shared product, vendor, weakness, or advisory.
CVE-2026-64648MediumNext.js: Cache confusion of response bodies for requests with bodies
CVE-2026-64649HighNext.js: Server-Side Request Forgery in Server Actions on custom servers
CVE-2026-64641HighNext.js: Denial of Service in App Router using Server Actions
CVE-2026-64643MediumNext.js: Unauthenticated disclosure of internal Server Function endpoints
CVE-2026-64644MediumNext.js: Denial of Service in the Image Optimization API using SVGs
CVE-2026-64645HighNext.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname