CVE-2026-64642

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-64642
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64642.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-64642
Aliases
Downstream
CGA (17)
CLEANSTART (3)
MINI (3)
ROOT (1)
Published
2026-07-27T17:45:40Z
Modified
2026-10-16T03:00:12Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
Details

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue has been fixed in version 16.2.11.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64642.json"
}
References

Affected packages

Git / github.com/vercel/next.js

Affected ranges

Type
GIT
Repo
https://github.com/vercel/next.js
Events
Introduced
950609f96f694c5475d18cd2d72a0052ca04d4b9
Fixed
9beca0821cf4606ae33466ed6f4fc75f2887a4da
Fixed
6bf4df14508ad6c0cd46af50c6051ee42f2d9151
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "range": [
                {
                    "introduced": "16.0.0"
                },
                {
                    "fixed": "16.2.11"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "6bf4df14508ad6c0cd46af50c6051ee42f2d9151"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v16.2.11",
            "range": [
                {
                    "fixed": "9beca0821cf4606ae33466ed6f4fc75f2887a4da"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v16.*
v16.0.0
v16.0.1
v16.0.1-canary.0
v16.0.1-canary.1
v16.0.1-canary.2
v16.0.1-canary.3
v16.0.1-canary.4
v16.0.1-canary.5
v16.0.1-canary.6
v16.0.2-canary.0
v16.0.2-canary.1
v16.0.2-canary.10
v16.0.2-canary.11
v16.0.2-canary.12
v16.0.2-canary.13
v16.0.2-canary.14
v16.0.2-canary.15
v16.0.2-canary.16
v16.0.2-canary.17
v16.0.2-canary.18
v16.0.2-canary.19
v16.0.2-canary.2
v16.0.2-canary.20
v16.0.2-canary.21
v16.0.2-canary.22
v16.0.2-canary.23
v16.0.2-canary.24
v16.0.2-canary.25
v16.0.2-canary.26
v16.0.2-canary.27
v16.0.2-canary.28
v16.0.2-canary.29
v16.0.2-canary.3
v16.0.2-canary.30
v16.0.2-canary.31
v16.0.2-canary.32
v16.0.2-canary.33
v16.0.2-canary.34
v16.0.2-canary.4
v16.0.2-canary.5
v16.0.2-canary.6
v16.0.2-canary.7
v16.0.2-canary.8
v16.0.2-canary.9
v16.1.0
v16.1.0-canary.0
v16.1.0-canary.1
v16.1.0-canary.10
v16.1.0-canary.11
v16.1.0-canary.12
v16.1.0-canary.13
v16.1.0-canary.14
v16.1.0-canary.15
v16.1.0-canary.16
v16.1.0-canary.17
v16.1.0-canary.18
v16.1.0-canary.19
v16.1.0-canary.2
v16.1.0-canary.20
v16.1.0-canary.21
v16.1.0-canary.22
v16.1.0-canary.23
v16.1.0-canary.24
v16.1.0-canary.25
v16.1.0-canary.26
v16.1.0-canary.27
v16.1.0-canary.28
v16.1.0-canary.29
v16.1.0-canary.3
v16.1.0-canary.30
v16.1.0-canary.31
v16.1.0-canary.32
v16.1.0-canary.33
v16.1.0-canary.34
v16.1.0-canary.4
v16.1.0-canary.5
v16.1.0-canary.6
v16.1.0-canary.7
v16.1.0-canary.8
v16.1.0-canary.9
v16.1.1-canary.0
v16.1.1-canary.1
v16.1.1-canary.10
v16.1.1-canary.11
v16.1.1-canary.12
v16.1.1-canary.13
v16.1.1-canary.14
v16.1.1-canary.15
v16.1.1-canary.16
v16.1.1-canary.17
v16.1.1-canary.18
v16.1.1-canary.19
v16.1.1-canary.2
v16.1.1-canary.20
v16.1.1-canary.21
v16.1.1-canary.22
v16.1.1-canary.23
v16.1.1-canary.24
v16.1.1-canary.25
v16.1.1-canary.26
v16.1.1-canary.27
v16.1.1-canary.28
v16.1.1-canary.29
v16.1.1-canary.3
v16.1.1-canary.30
v16.1.1-canary.31
v16.1.1-canary.32
v16.1.1-canary.33
v16.1.1-canary.34
v16.1.1-canary.35
v16.1.1-canary.36
v16.1.1-canary.4
v16.1.1-canary.5
v16.1.1-canary.6
v16.1.1-canary.7
v16.1.1-canary.8
v16.1.1-canary.9
v16.2.0
v16.2.0-canary.0
v16.2.0-canary.1
v16.2.0-canary.10
v16.2.0-canary.100
v16.2.0-canary.101
v16.2.0-canary.102
v16.2.0-canary.103
v16.2.0-canary.104
v16.2.0-canary.11
v16.2.0-canary.12
v16.2.0-canary.13
v16.2.0-canary.14
v16.2.0-canary.15
v16.2.0-canary.16
v16.2.0-canary.17
v16.2.0-canary.18
v16.2.0-canary.19
v16.2.0-canary.2
v16.2.0-canary.20
v16.2.0-canary.21
v16.2.0-canary.22
v16.2.0-canary.23
v16.2.0-canary.24
v16.2.0-canary.25
v16.2.0-canary.26
v16.2.0-canary.27
v16.2.0-canary.28
v16.2.0-canary.29
v16.2.0-canary.3
v16.2.0-canary.30
v16.2.0-canary.31
v16.2.0-canary.32
v16.2.0-canary.33
v16.2.0-canary.34
v16.2.0-canary.35
v16.2.0-canary.36
v16.2.0-canary.37
v16.2.0-canary.38
v16.2.0-canary.39
v16.2.0-canary.4
v16.2.0-canary.40
v16.2.0-canary.41
v16.2.0-canary.42
v16.2.0-canary.43
v16.2.0-canary.44
v16.2.0-canary.45
v16.2.0-canary.46
v16.2.0-canary.47
v16.2.0-canary.48
v16.2.0-canary.49
v16.2.0-canary.5
v16.2.0-canary.50
v16.2.0-canary.51
v16.2.0-canary.52
v16.2.0-canary.53
v16.2.0-canary.54
v16.2.0-canary.55
v16.2.0-canary.56
v16.2.0-canary.57
v16.2.0-canary.58
v16.2.0-canary.59
v16.2.0-canary.6
v16.2.0-canary.60
v16.2.0-canary.61
v16.2.0-canary.62
v16.2.0-canary.63
v16.2.0-canary.64
v16.2.0-canary.65
v16.2.0-canary.66
v16.2.0-canary.67
v16.2.0-canary.68
v16.2.0-canary.69
v16.2.0-canary.7
v16.2.0-canary.70
v16.2.0-canary.71
v16.2.0-canary.72
v16.2.0-canary.73
v16.2.0-canary.74
v16.2.0-canary.75
v16.2.0-canary.76
v16.2.0-canary.77
v16.2.0-canary.78
v16.2.0-canary.79
v16.2.0-canary.8
v16.2.0-canary.80
v16.2.0-canary.81
v16.2.0-canary.82
v16.2.0-canary.83
v16.2.0-canary.84
v16.2.0-canary.85
v16.2.0-canary.86
v16.2.0-canary.87
v16.2.0-canary.88
v16.2.0-canary.89
v16.2.0-canary.9
v16.2.0-canary.90
v16.2.0-canary.91
v16.2.0-canary.92
v16.2.0-canary.93
v16.2.0-canary.94
v16.2.0-canary.95
v16.2.0-canary.96
v16.2.0-canary.97
v16.2.0-canary.98
v16.2.0-canary.99
v16.2.1
v16.2.1-canary.0
v16.2.1-canary.1
v16.2.1-canary.10
v16.2.1-canary.11
v16.2.1-canary.12
v16.2.1-canary.13
v16.2.1-canary.14
v16.2.1-canary.15
v16.2.1-canary.16
v16.2.1-canary.17
v16.2.1-canary.18
v16.2.1-canary.19
v16.2.1-canary.2
v16.2.1-canary.20
v16.2.1-canary.21
v16.2.1-canary.22
v16.2.1-canary.23
v16.2.1-canary.24
v16.2.1-canary.25
v16.2.1-canary.26
v16.2.1-canary.27
v16.2.1-canary.28
v16.2.1-canary.29
v16.2.1-canary.3
v16.2.1-canary.30
v16.2.1-canary.31
v16.2.1-canary.32
v16.2.1-canary.33
v16.2.1-canary.34
v16.2.1-canary.35
v16.2.1-canary.36
v16.2.1-canary.37
v16.2.1-canary.38
v16.2.1-canary.39
v16.2.1-canary.4
v16.2.1-canary.40
v16.2.1-canary.41
v16.2.1-canary.42
v16.2.1-canary.43
v16.2.1-canary.44
v16.2.1-canary.45
v16.2.1-canary.46
v16.2.1-canary.5
v16.2.1-canary.6
v16.2.1-canary.7
v16.2.1-canary.8
v16.2.1-canary.9
v16.2.10
v16.2.2
v16.2.3
v16.2.4
v16.2.5
v16.2.6
v16.2.8
v16.2.9
v16.3.0-canary.0
v16.3.0-canary.1
v16.3.0-canary.10
v16.3.0-canary.11
v16.3.0-canary.12
v16.3.0-canary.13
v16.3.0-canary.14
v16.3.0-canary.15
v16.3.0-canary.16
v16.3.0-canary.17
v16.3.0-canary.18
v16.3.0-canary.19
v16.3.0-canary.2
v16.3.0-canary.20
v16.3.0-canary.21
v16.3.0-canary.22
v16.3.0-canary.23
v16.3.0-canary.24
v16.3.0-canary.25
v16.3.0-canary.26
v16.3.0-canary.27
v16.3.0-canary.28
v16.3.0-canary.29
v16.3.0-canary.3
v16.3.0-canary.30
v16.3.0-canary.31
v16.3.0-canary.32
v16.3.0-canary.33
v16.3.0-canary.34
v16.3.0-canary.35
v16.3.0-canary.36
v16.3.0-canary.37
v16.3.0-canary.38
v16.3.0-canary.39
v16.3.0-canary.4
v16.3.0-canary.40
v16.3.0-canary.41
v16.3.0-canary.42
v16.3.0-canary.43
v16.3.0-canary.44
v16.3.0-canary.45
v16.3.0-canary.46
v16.3.0-canary.47
v16.3.0-canary.48
v16.3.0-canary.49
v16.3.0-canary.5
v16.3.0-canary.50
v16.3.0-canary.51
v16.3.0-canary.52
v16.3.0-canary.53
v16.3.0-canary.54
v16.3.0-canary.55
v16.3.0-canary.56
v16.3.0-canary.57
v16.3.0-canary.58
v16.3.0-canary.59
v16.3.0-canary.6
v16.3.0-canary.60
v16.3.0-canary.61
v16.3.0-canary.62
v16.3.0-canary.63
v16.3.0-canary.64
v16.3.0-canary.65
v16.3.0-canary.66
v16.3.0-canary.67
v16.3.0-canary.68
v16.3.0-canary.69
v16.3.0-canary.7
v16.3.0-canary.70
v16.3.0-canary.71
v16.3.0-canary.72
v16.3.0-canary.73
v16.3.0-canary.74
v16.3.0-canary.75
v16.3.0-canary.76
v16.3.0-canary.77
v16.3.0-canary.78
v16.3.0-canary.79
v16.3.0-canary.8
v16.3.0-canary.80
v16.3.0-canary.81
v16.3.0-canary.82
v16.3.0-canary.83
v16.3.0-canary.84
v16.3.0-canary.85
v16.3.0-canary.86
v16.3.0-canary.87
v16.3.0-canary.88
v16.3.0-canary.89
v16.3.0-canary.9
v16.3.0-canary.90
v16.3.0-canary.91
v16.3.0-preview.4
v16.3.0-preview.5
v16.3.0-preview.6

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64642.json"