Skip to content
Threat Feed
Subscribe

Tag

Middleware-Bypass

3 briefs RSS
high advisory

Next.js App Router Middleware/Proxy Bypass Vulnerability (CVE-2026-64642)

A high-severity vulnerability, CVE-2026-64642, in Next.js App Router applications built with Turbopack and configured with a single locale entry allows attackers to bypass middleware and proxy-based authentication mechanisms through specially crafted HTTP requests, leading to unauthorized access to protected resources.

Next.js web-vulnerability middleware-bypass turbopack CVE-2026-64642
2t
high advisory

@fastify/middie Middleware Bypass Vulnerability via Duplicate Slashes

`@fastify/middie` versions 9.3.1 and earlier are vulnerable to middleware bypass via URLs with duplicate leading slashes due to improper handling of the deprecated `ignoreDuplicateSlashes` option, potentially allowing unauthorized access to protected resources.

Fastify +1 middie middleware-bypass vulnerability defense-evasion
2r 1t 1c
high advisory

FlightPHP HTTP Method Override Vulnerability Leads to CSRF and Middleware Bypass

A vulnerability in FlightPHP core versions before 3.18.1 allows attackers to override HTTP methods via the `X-HTTP-Method-Override` header or `_method` parameter, leading to CSRF escalation, middleware bypass, and cache poisoning.

flightphp/core csrf middleware-bypass cache-poisoning http-method-override
2r 1t