GitHub Advisoryadvisory · npm

GHSA-6gpp-xcg3-4w24 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

HIGH Published 2026-07-22 Modified 2026-07-22 Official page ↗
Aliases
CVE-2026-64642
Ecosystem
npm
Packages
next
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-285
Reviewed
2026-07-22

Affected packages

• npm next: >= 16.0.0, < 16.2.11 → fixed in 16.2.11

Description

Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in `config.i18n.locales` can bypass middleware/proxy based authentication. Workarounds If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.

Related

Alias · CVE (1)

  • CVE-2026-64642 Next.js is a React framework for building full-stack web applications. vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References