Vulnerability Description
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue has been fixed in version 16.2.11.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vercel | Next.Js | >= 16.0.0, < 16.2.11 |
Related Weaknesses (CWE)
References
- https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d915Patch
- https://github.com/vercel/next.js/pull/96014Issue TrackingPatch
- https://github.com/vercel/next.js/releases/tag/v16.2.11ProductRelease Notes
- https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24Vendor Advisory
FAQ
What is CVE-2026-64642?
CVE-2026-64642 is a vulnerability with a CVSS score of 8.2 (HIGH). Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a s...
How severe is CVE-2026-64642?
CVE-2026-64642 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-64642?
Check the references section above for vendor advisories and patch information. Affected products include: Vercel Next.Js.