CVE-2026-64642

Summary

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Severity

high

EPSS

0.6% (p50)

CWE

CWE-285

Also known as

GHSA-6gpp-xcg3-4w24

Published

2026-07-22

Updated

2026-07-22

Advisory details

Impact

Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication.

Workarounds

If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.

References

• https://github.com/advisories/GHSA-6gpp-xcg3-4w24
• https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24
• https://github.com/vercel/next.js/pull/96014
• https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151
• https://github.com/vercel/next.js/releases/tag/v16.2.11

Related advisories

• GHSA-673q-mjm6-r5xr — critical · npm/next
• GHSA-2464-fhr4-w9xw — critical · npm/next
• GHSA-vcvr-r3jv-pc5j — critical · npm/next
• GHSA-2xp9-vwfh-vxw4 — critical · npm/next
• CVE-2026-75604 — critical · npm/next
• CVE-2026-94482 — high · npm/next
• CVE-2026-94483 — high · npm/next
• CVE-2026-64649 — high · npm/next

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity