CVE-2026-64642: Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
Impact
Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication.
Workarounds
If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.
Other sources
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue has been fixed in version 16.2.11.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.2.11 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.2.11 - Configuration
If you cannot upgrade from 16.0.0 through 16.2.10, enforce authorization in the page's server-side data path instead of relying solely on middleware/proxy based authentication.
Next.js (App Router) Authorization enforcement location = Server-side data path
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64642?
CVE-2026-64642 has a risk rating of 62, indicating a moderate level of severity.
How do I fix CVE-2026-64642?
To fix CVE-2026-64642, upgrade your Next.js application to the latest version that addresses the vulnerability.
What type of applications are affected by CVE-2026-64642?
CVE-2026-64642 affects Next.js applications using App Router built with Turbopack that have a single entry in config.i18n.locales.
What could happen if CVE-2026-64642 is exploited?
Exploitation of CVE-2026-64642 can allow unauthorized access by bypassing middleware or proxy-based authentication.
Are there any workarounds for CVE-2026-64642?
If immediate upgrading is not possible, enforce authorization in the page's server-side data processing as a workaround.