CVE-2026-64642: Vercel Next.js Auth Bypass Vulnerability

CVE-2026-64642 Overview

CVE-2026-64642 is an authorization bypass vulnerability in Vercel Next.js, a React framework for building full-stack web applications. Versions 16.0.0 through 16.2.10 are affected when applications use the App Router built with Turbopack and configure a single entry in config.i18n.locales. Crafted requests can bypass middleware or proxy-based authentication logic, allowing attackers to reach protected routes without valid credentials. The issue is tracked under CWE-285: Improper Authorization and was fixed in version 16.2.11.

Critical Impact
Remote unauthenticated attackers can bypass middleware-enforced authentication and access protected application routes over the network.

Affected Products

Vercel Next.js 16.0.0 through 16.2.10 (App Router + Turbopack builds)
Applications configured with a single locale in config.i18n.locales
Deployments relying on Next.js middleware or proxy-based authentication

Discovery Timeline

2026-07-27 - CVE-2026-64642 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-64642

Vulnerability Analysis

The vulnerability resides in how Turbopack generates middleware matchers when internationalization (i18n) is configured. Next.js middleware commonly enforces authentication by intercepting incoming requests and validating session tokens before routing them to protected pages. When Turbopack builds the middleware manifest, it inspects the i18n configuration to decide which request paths require middleware execution. Under the vulnerable logic, applications declaring only one locale in config.i18n.locales produced a matcher set that failed to cover all request variants, leaving protected routes reachable without middleware evaluation.

Because the flaw executes purely through crafted HTTP requests, exploitation requires no authentication and no user interaction. The EPSS model estimates a 0.948% probability of exploitation within 30 days, placing it in the 57.6 percentile.

Root Cause

The root cause is an incorrect boolean condition in crates/next-api/src/middleware.rs. The prior implementation treated i18n as active only when locales.len() > 1, which excluded single-locale configurations from middleware coverage. Requests routed under the single-locale path bypassed the middleware matcher entirely, defeating any authorization checks it enforced.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP requests to a vulnerable Next.js deployment. By exploiting the mismatch between the generated middleware matcher and the actual routing behavior, the attacker reaches routes that middleware was expected to gate, including those protected by authentication or authorization checks implemented in middleware.ts.

rust

         let next_config = this.project.next_config();
         let i18n = next_config.i18n().await?;
         let has_i18n = i18n.is_some();
-        let has_i18n_locales = i18n
-            .as_ref()
-            .map(|i18n| i18n.locales.len() > 1)
-            .unwrap_or(false);
+        let has_i18n_locales = i18n.is_some();
         let base_path = next_config.base_path().await?;

         let matchers = if let Some(matchers) = config.middleware_matcher.as_ref() {
// Source: https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151

The patch replaces the locales.len() > 1 check with i18n.is_some(), ensuring middleware matchers apply whenever i18n is configured, regardless of locale count.

Detection Methods for CVE-2026-64642

Indicators of Compromise

HTTP 200 responses on routes that should return 401 or 302 from middleware-based authentication
Access log entries for protected paths lacking corresponding middleware execution traces
Requests to i18n-prefixed and non-prefixed variants of the same protected route returning inconsistent authorization outcomes

Detection Strategies

Inventory Next.js applications and identify builds using App Router with Turbopack and a single locale in config.i18n.locales
Review application logs to correlate middleware invocation counts against request counts for protected routes
Perform automated route-coverage testing that compares middleware matcher output against actual protected paths

Monitoring Recommendations

Alert on unauthenticated access to routes that require session cookies or bearer tokens
Monitor egress from Next.js deployments for anomalous data retrieval following requests missing authentication headers
Track Next.js runtime versions across environments and flag any instance running 16.0.0 through 16.2.10

How to Mitigate CVE-2026-64642

Immediate Actions Required

Upgrade Next.js to version 16.2.11 or later across all environments
Audit middleware.ts and next.config.js for reliance on middleware-based authentication combined with single-locale i18n
Rotate any credentials or session tokens that may have been exposed through bypassed routes

Patch Information

The fix is available in Next.js 16.2.11. See the Next.js Release Notes v16.2.11, the GitHub Security Advisory GHSA-6gpp-xcg3-4w24, and the upstream patch commit.

Workarounds

Add additional locale entries to config.i18n.locales to force the matcher into the multi-locale path
Move authentication enforcement from Next.js middleware to a reverse proxy or API gateway in front of the application
Implement per-route authorization checks inside server components or route handlers as defense in depth

bash

# Upgrade Next.js to the patched release
npm install next@16.2.11

# Verify installed version
npx next --version