Next.js (>= 16.0.0, < 16.2.11) - CraftedSignal Threat Feed

Next.js App Router Middleware/Proxy Bypass Vulnerability (CVE-2026-64642)

hello@craftedsignal.io — Wed, 22 Jul 2026 23:04:48 +0000

A critical vulnerability, tracked as CVE-2026-64642, has been identified in Next.js applications utilizing the App Router, built with Turbopack, and configured with a single entry in config.i18n.locales. This flaw enables an unauthenticated attacker to craft specific HTTP requests that bypass authentication mechanisms implemented via middleware or a proxy. The vulnerability allows unauthorized access to resources and data that should otherwise be protected, potentially compromising the confidentiality of sensitive information. This issue affects Next.js versions 16.0.0 up to, but not including, 16.2.11, and was patched in version 16.2.11. Defenders need to prioritize patching to prevent unauthorized access to their applications.

Attack Chain

An attacker identifies a public-facing Next.js application that uses the App Router, is built with Turbopack, and has a config.i18n.locales configuration with only one locale entry.
The attacker crafts a specially formed HTTP request, potentially manipulating URI paths, headers, or query parameters, targeting a resource typically protected by the application's middleware or proxy.
The Next.js application processes the crafted HTTP request before the middleware or proxy can correctly enforce authorization policies.
Due to the underlying logic flaw (CVE-2026-64642) related to Turbopack and single locale configuration, the application's routing mechanism inadvertently circumvents the authentication checks.
The attacker successfully bypasses the middleware or proxy-based authentication mechanism.
The application grants the attacker unauthorized access to protected pages, API routes, or other resources, enabling data exfiltration or further malicious actions depending on the nature of the exposed resources.

Impact

Successful exploitation of CVE-2026-64642 results in unauthorized access to sensitive or protected resources within Next.js applications. This can lead to severe consequences, including the exposure of confidential user data, administrative credentials, or proprietary business information. Organizations relying on middleware or proxy layers for authentication and authorization in their Next.js App Router applications (versions >= 16.0.0, < 16.2.11) are at risk of data breaches and compromise of application integrity. While no specific victim counts or targeted sectors are provided, any organization running affected Next.js configurations is vulnerable.

Recommendation

Upgrade all affected Next.js App Router applications to version 16.2.11 or newer to remediate CVE-2026-64642 immediately.
If immediate upgrade is not possible, enforce authorization checks directly within the page's server-side data fetching logic instead of solely relying on middleware for protection against CVE-2026-64642.

Next.js: Denial of Service in App Router using Server Actions

hello@craftedsignal.io — Wed, 22 Jul 2026 22:59:42 +0000

A high-severity denial-of-service vulnerability, identified as CVE-2026-64641, affects Next.js applications that are configured to use the App Router alongside at least one Server Action. This flaw allows an unauthenticated remote attacker to send specially crafted HTTP requests to the vulnerable application. Upon receiving such a request, the Next.js process can enter a state of excessive CPU utilization, thereby blocking the processing of all further legitimate requests. This sustained resource exhaustion leads to a complete unavailability of the web service for legitimate users. The vulnerability affects Next.js versions greater than or equal to 13.0.0 and less than 15.5.21, as well as versions greater than or equal to 16.0.0 and less than 16.2.11. Applications not employing the App Router or Server Actions are not susceptible. This vulnerability poses a significant risk to the availability of critical web applications built with Next.js, making immediate patching crucial for maintaining service uptime.

Attack Chain

An unauthenticated attacker sends a specially crafted HTTP request to a vulnerable Next.js application endpoint.
The crafted request specifically targets an application configured with the App Router and at least one Server Action.
Processing the malicious request triggers an uncontrolled internal operation, causing the Next.js application process to consume excessive CPU resources.
The sustained, high CPU utilization overwhelms the application, preventing it from handling legitimate incoming requests.
The Next.js application becomes unresponsive, resulting in a denial of service for all users.

Impact

Successful exploitation of CVE-2026-64641 leads to a complete denial of service for affected Next.js applications. Attackers can trigger excessive CPU usage in the application process, which in turn blocks the processing of all further requests. This effectively renders the web application inaccessible to legitimate users, disrupting business operations and potentially causing significant financial losses due to service downtime. There is no observed data on the number of victims or specific sectors targeted, but any organization using vulnerable Next.js versions with the App Router and Server Actions is at risk.

Recommendation

Patch CVE-2026-64641 immediately by upgrading Next.js to version 15.5.21 or later, or 16.2.11 or later, as referenced in the affected_products section.
Monitor CPU utilization on servers hosting Next.js applications, especially those using App Router and Server Actions, for anomalous spikes indicative of a DoS attack.
Monitor web server access logs for unusual patterns or high request rates directed towards Next.js App Router endpoints that utilize Server Actions.