{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/next.js--16.0.0--16.2.11/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Next.js (\u003e= 16.0.0, \u003c 16.2.11)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","middleware-bypass","next.js","turbopack","CVE-2026-64642"],"_cs_type":"advisory","_cs_vendors":["Vercel"],"content_html":"\u003cp\u003eA critical vulnerability, tracked as CVE-2026-64642, has been identified in Next.js applications utilizing the App Router, built with Turbopack, and configured with a single entry in \u003ccode\u003econfig.i18n.locales\u003c/code\u003e. This flaw enables an unauthenticated attacker to craft specific HTTP requests that bypass authentication mechanisms implemented via middleware or a proxy. The vulnerability allows unauthorized access to resources and data that should otherwise be protected, potentially compromising the confidentiality of sensitive information. This issue affects Next.js versions 16.0.0 up to, but not including, 16.2.11, and was patched in version 16.2.11. Defenders need to prioritize patching to prevent unauthorized access to their applications.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a public-facing Next.js application that uses the App Router, is built with Turbopack, and has a \u003ccode\u003econfig.i18n.locales\u003c/code\u003e configuration with only one locale entry.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a specially formed HTTP request, potentially manipulating URI paths, headers, or query parameters, targeting a resource typically protected by the application's middleware or proxy.\u003c/li\u003e\n\u003cli\u003eThe Next.js application processes the crafted HTTP request before the middleware or proxy can correctly enforce authorization policies.\u003c/li\u003e\n\u003cli\u003eDue to the underlying logic flaw (CVE-2026-64642) related to Turbopack and single locale configuration, the application's routing mechanism inadvertently circumvents the authentication checks.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully bypasses the middleware or proxy-based authentication mechanism.\u003c/li\u003e\n\u003cli\u003eThe application grants the attacker unauthorized access to protected pages, API routes, or other resources, enabling data exfiltration or further malicious actions depending on the nature of the exposed resources.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-64642 results in unauthorized access to sensitive or protected resources within Next.js applications. This can lead to severe consequences, including the exposure of confidential user data, administrative credentials, or proprietary business information. Organizations relying on middleware or proxy layers for authentication and authorization in their Next.js App Router applications (versions \u0026gt;= 16.0.0, \u0026lt; 16.2.11) are at risk of data breaches and compromise of application integrity. While no specific victim counts or targeted sectors are provided, any organization running affected Next.js configurations is vulnerable.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all affected Next.js App Router applications to version 16.2.11 or newer to remediate CVE-2026-64642 immediately.\u003c/li\u003e\n\u003cli\u003eIf immediate upgrade is not possible, enforce authorization checks directly within the page's server-side data fetching logic instead of solely relying on middleware for protection against CVE-2026-64642.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T23:04:48Z","date_published":"2026-07-22T23:04:48Z","id":"https://feed.craftedsignal.io/briefs/2026-07-nextjs-middleware-bypass/","summary":"A high-severity vulnerability, CVE-2026-64642, in Next.js App Router applications built with Turbopack and configured with a single locale entry allows attackers to bypass middleware and proxy-based authentication mechanisms through specially crafted HTTP requests, leading to unauthorized access to protected resources.","title":"Next.js App Router Middleware/Proxy Bypass Vulnerability (CVE-2026-64642)","url":"https://feed.craftedsignal.io/briefs/2026-07-nextjs-middleware-bypass/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Next.js (\u003e= 13.0.0, \u003c 15.5.21)","Next.js (\u003e= 16.0.0, \u003c 16.2.11)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","web-application","javascript","nodejs"],"_cs_type":"advisory","_cs_vendors":["Vercel"],"content_html":"\u003cp\u003eA high-severity denial-of-service vulnerability, identified as CVE-2026-64641, affects Next.js applications that are configured to use the App Router alongside at least one Server Action. This flaw allows an unauthenticated remote attacker to send specially crafted HTTP requests to the vulnerable application. Upon receiving such a request, the Next.js process can enter a state of excessive CPU utilization, thereby blocking the processing of all further legitimate requests. This sustained resource exhaustion leads to a complete unavailability of the web service for legitimate users. The vulnerability affects Next.js versions greater than or equal to 13.0.0 and less than 15.5.21, as well as versions greater than or equal to 16.0.0 and less than 16.2.11. Applications not employing the App Router or Server Actions are not susceptible. This vulnerability poses a significant risk to the availability of critical web applications built with Next.js, making immediate patching crucial for maintaining service uptime.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker sends a specially crafted HTTP request to a vulnerable Next.js application endpoint.\u003c/li\u003e\n\u003cli\u003eThe crafted request specifically targets an application configured with the App Router and at least one Server Action.\u003c/li\u003e\n\u003cli\u003eProcessing the malicious request triggers an uncontrolled internal operation, causing the Next.js application process to consume excessive CPU resources.\u003c/li\u003e\n\u003cli\u003eThe sustained, high CPU utilization overwhelms the application, preventing it from handling legitimate incoming requests.\u003c/li\u003e\n\u003cli\u003eThe Next.js application becomes unresponsive, resulting in a denial of service for all users.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-64641 leads to a complete denial of service for affected Next.js applications. Attackers can trigger excessive CPU usage in the application process, which in turn blocks the processing of all further requests. This effectively renders the web application inaccessible to legitimate users, disrupting business operations and potentially causing significant financial losses due to service downtime. There is no observed data on the number of victims or specific sectors targeted, but any organization using vulnerable Next.js versions with the App Router and Server Actions is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-64641 immediately by upgrading Next.js to version 15.5.21 or later, or 16.2.11 or later, as referenced in the affected_products section.\u003c/li\u003e\n\u003cli\u003eMonitor CPU utilization on servers hosting Next.js applications, especially those using App Router and Server Actions, for anomalous spikes indicative of a DoS attack.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for unusual patterns or high request rates directed towards Next.js App Router endpoints that utilize Server Actions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T22:59:42Z","date_published":"2026-07-22T22:59:42Z","id":"https://feed.craftedsignal.io/briefs/2026-07-nextjs-dos/","summary":"A high-severity denial-of-service vulnerability (CVE-2026-64641) in Next.js applications utilizing the App Router with Server Actions allows an unauthenticated attacker to cause excessive CPU usage, leading to a complete service outage.","title":"Next.js: Denial of Service in App Router using Server Actions","url":"https://feed.craftedsignal.io/briefs/2026-07-nextjs-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Next.js (\u003e= 16.0.0, \u003c 16.2.11)","version":"https://jsonfeed.org/version/1.1"}