Skip to content
Threat Feed
Subscribe

Product

Next.js (>= 16.0.0, < 16.2.11)

2 briefs RSS
high advisory

Next.js App Router Middleware/Proxy Bypass Vulnerability (CVE-2026-64642)

A high-severity vulnerability, CVE-2026-64642, in Next.js App Router applications built with Turbopack and configured with a single locale entry allows attackers to bypass middleware and proxy-based authentication mechanisms through specially crafted HTTP requests, leading to unauthorized access to protected resources.

Next.js web-vulnerability middleware-bypass turbopack CVE-2026-64642
2t
medium advisory

Next.js: Denial of Service in App Router using Server Actions

A high-severity denial-of-service vulnerability (CVE-2026-64641) in Next.js applications utilizing the App Router with Server Actions allows an unauthenticated attacker to cause excessive CPU usage, leading to a complete service outage.

Next.js +1 denial-of-service web-application javascript nodejs
1t