~ / search / GHSA-6gpp-xcg3-4w24

GHSA-6gpp-xcg3-4w24

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Source: GitHub Advisory Database (reviewed) High CVE-2026-64642

Packages

EcosystemPackageAffectedFixed in
npm next >= 16.0.0, < 16.2.11 16.2.11

Details

As written in the advisory (Markdown source, shown as plain text).

## Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a **single** entry in `config.i18n.locales` can bypass middleware/proxy based authentication. ## Workarounds If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.

References

External links from the advisory. They lead to third-party sites.