Skip to content
Threat Feed
Subscribe

Tag

Turbopack

1 brief RSS
high advisory

Next.js App Router Middleware/Proxy Bypass Vulnerability (CVE-2026-64642)

A high-severity vulnerability, CVE-2026-64642, in Next.js App Router applications built with Turbopack and configured with a single locale entry allows attackers to bypass middleware and proxy-based authentication mechanisms through specially crafted HTTP requests, leading to unauthorized access to protected resources.

Next.js web-vulnerability middleware-bypass turbopack CVE-2026-64642
2t