{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/turbopack/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Next.js (\u003e= 16.0.0, \u003c 16.2.11)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","middleware-bypass","next.js","turbopack","CVE-2026-64642"],"_cs_type":"advisory","_cs_vendors":["Vercel"],"content_html":"\u003cp\u003eA critical vulnerability, tracked as CVE-2026-64642, has been identified in Next.js applications utilizing the App Router, built with Turbopack, and configured with a single entry in \u003ccode\u003econfig.i18n.locales\u003c/code\u003e. This flaw enables an unauthenticated attacker to craft specific HTTP requests that bypass authentication mechanisms implemented via middleware or a proxy. The vulnerability allows unauthorized access to resources and data that should otherwise be protected, potentially compromising the confidentiality of sensitive information. This issue affects Next.js versions 16.0.0 up to, but not including, 16.2.11, and was patched in version 16.2.11. Defenders need to prioritize patching to prevent unauthorized access to their applications.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a public-facing Next.js application that uses the App Router, is built with Turbopack, and has a \u003ccode\u003econfig.i18n.locales\u003c/code\u003e configuration with only one locale entry.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a specially formed HTTP request, potentially manipulating URI paths, headers, or query parameters, targeting a resource typically protected by the application's middleware or proxy.\u003c/li\u003e\n\u003cli\u003eThe Next.js application processes the crafted HTTP request before the middleware or proxy can correctly enforce authorization policies.\u003c/li\u003e\n\u003cli\u003eDue to the underlying logic flaw (CVE-2026-64642) related to Turbopack and single locale configuration, the application's routing mechanism inadvertently circumvents the authentication checks.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully bypasses the middleware or proxy-based authentication mechanism.\u003c/li\u003e\n\u003cli\u003eThe application grants the attacker unauthorized access to protected pages, API routes, or other resources, enabling data exfiltration or further malicious actions depending on the nature of the exposed resources.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-64642 results in unauthorized access to sensitive or protected resources within Next.js applications. This can lead to severe consequences, including the exposure of confidential user data, administrative credentials, or proprietary business information. Organizations relying on middleware or proxy layers for authentication and authorization in their Next.js App Router applications (versions \u0026gt;= 16.0.0, \u0026lt; 16.2.11) are at risk of data breaches and compromise of application integrity. While no specific victim counts or targeted sectors are provided, any organization running affected Next.js configurations is vulnerable.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all affected Next.js App Router applications to version 16.2.11 or newer to remediate CVE-2026-64642 immediately.\u003c/li\u003e\n\u003cli\u003eIf immediate upgrade is not possible, enforce authorization checks directly within the page's server-side data fetching logic instead of solely relying on middleware for protection against CVE-2026-64642.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T23:04:48Z","date_published":"2026-07-22T23:04:48Z","id":"https://feed.craftedsignal.io/briefs/2026-07-nextjs-middleware-bypass/","summary":"A high-severity vulnerability, CVE-2026-64642, in Next.js App Router applications built with Turbopack and configured with a single locale entry allows attackers to bypass middleware and proxy-based authentication mechanisms through specially crafted HTTP requests, leading to unauthorized access to protected resources.","title":"Next.js App Router Middleware/Proxy Bypass Vulnerability (CVE-2026-64642)","url":"https://feed.craftedsignal.io/briefs/2026-07-nextjs-middleware-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Turbopack","version":"https://jsonfeed.org/version/1.1"}