---
id: CVE-2026-64642
aliases:
  - GHSA-6gpp-xcg3-4w24
title: >-
  Next.js: Middleware / Proxy bypass in App Router applications using Turbopack
  and single locale
summary: >-
  Next.js: Middleware / Proxy bypass in App Router applications using Turbopack
  and single locale
severity: high
cwe:
  - CWE-285
vendor: next
product: next
ecosystem: npm
affected:
  - 'next >= 16.0.0, < 16.2.11'
patched:
  - next 16.2.11
published: '2026-07-22'
updated: '2026-07-22'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-6gpp-xcg3-4w24'
references:
  - url: 'https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24'
  - url: 'https://github.com/vercel/next.js/pull/96014'
  - url: >-
      https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151
  - url: 'https://github.com/vercel/next.js/releases/tag/v16.2.11'
  - url: 'https://github.com/advisories/GHSA-6gpp-xcg3-4w24'
tags:
  - ghsa
  - npm
ingestedAt: '2026-07-22T23:07:32.286Z'
epss: 0.00635
epssPercentile: 0.48229
---

## Overview

## Impact

Crafted requests targeting Next.js applications using App Router built with Turbopack and a **single** entry in `config.i18n.locales` can bypass middleware/proxy based authentication.

## Workarounds

If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.

## Affected packages

- `next >= 16.0.0, < 16.2.11`

## Remediation

Upgrade to a patched release:

- `next 16.2.11`