CVE-2026-64642 — Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built…
Published: 2026-07-27 · CVSS: 8.3 · CVSS 4.0
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue has been fixed in version 16.2.11.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7