UNKNOWN npm
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
GHSA-6gpp-xcg3-4w24 · CVE-2026-64642
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication.
Workarounds
If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.
References
- WEB https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24
- WEB https://github.com/vercel/next.js/pull/96014
- WEB https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151
- PACKAGE https://github.com/vercel/next.js
- WEB https://github.com/vercel/next.js/releases/tag/v16.2.11
Ready to move
Start Securing
Free, no credit card | First findings in minutes