CVE-2026-64642 in Next.js
Summary
by MITRE • 07/27/2026
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue has been fixed in version 16.2.11.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/27/2026
This vulnerability affects Next.js applications utilizing the App Router with Turbopack and internationalization configurations containing a single locale entry. The flaw enables authenticated users to bypass middleware-based access controls through carefully crafted HTTP requests that exploit how the framework processes routing and authentication checks when multiple locales are configured but only one is specified in the i18n.locales array. This represents a critical authorization bypass vulnerability that undermines the security controls implemented through middleware layers.
The technical root cause stems from improper handling of request routing within Next.js's App Router implementation when processing internationalized applications with specific locale configurations. When an application has multiple locales defined but only one specified in config.i18n.locales, the framework fails to properly validate and authenticate requests that target routes designed for different locales. This occurs during the middleware execution phase where authentication checks should prevent unauthorized access to protected resources. The vulnerability manifests when malicious actors craft requests that exploit this misconfiguration to traverse authentication boundaries without proper authorization.
The operational impact of this vulnerability extends beyond simple access control bypasses as it can enable attackers to gain unauthorized access to protected application features, user data, and administrative functions depending on the middleware implementation. In environments where Next.js applications serve sensitive content or handle privileged operations through middleware-based authentication, this flaw could allow unauthorized users to escalate privileges or access restricted resources that should only be available to authenticated users with appropriate permissions. The vulnerability particularly affects applications using Turbopack as the build system, which introduces additional complexity in how routing and middleware are processed.
Organizations running affected Next.js versions should immediately upgrade to version 16.2.11 or later to remediate this vulnerability. Security teams should conduct comprehensive audits of their middleware implementations to identify potential unauthorized access paths that could be exploited through this vulnerability. Additionally, administrators should review their i18n configuration settings and ensure proper validation of locale specifications within application configurations. This issue aligns with CWE-285 (Improper Authorization) and can be categorized under ATT&CK technique T1078 (Valid Accounts) as it exploits legitimate authentication mechanisms to bypass authorization controls.
The vulnerability demonstrates the complexity involved in internationalization implementations within modern web frameworks where locale handling intersects with security controls. Applications using Next.js with App Router and Turbopack should implement additional runtime checks and validate authentication state regardless of routing parameters or locale configurations. Regular security testing should include validation of middleware behavior under various locale scenarios to prevent similar authorization bypass issues from being introduced in future deployments. This vulnerability serves as a reminder of the critical importance of thorough testing when implementing internationalization features alongside security controls in web applications.