npm/next CVE-2026-64642: high, EPSS 0.64%

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Action: Upgrade next to 16.2.11 or later.

npm i next@16.2.11

Affected

Fixed versions

Sources

• osv: GHSA-6gpp-xcg3-4w24
• https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24
• https://github.com/vercel/next.js/pull/96014
• https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151
• https://github.com/vercel/next.js
• https://github.com/vercel/next.js/releases/tag/v16.2.11

CVE-2026-64642 · published 2026-07-22T22:59:38Z · modified 2026-09-10T03:51:10.700589078Z · JSON