Packages / next / Security

HighVulnerabilityGHSA-6gpp-xcg3-4w24CVE-2026-64642Published 22 Jul 2026

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Affected releases · next

  • 16.x16.0.0 – 16.2.10Fixed in 16.2.11

On 16.x, the newest line:

npm install next@16.2.11

  1. Not affected

    0.1.0 – 15.5.28

    378 releases

  2. Affected

    16.0.0 – 16.2.10

    31 releases

  3. Fixed

    16.2.11 – 16.4.2

    14 releases, latest

423 stable releases of next, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Impact

Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication.

Workarounds

If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.