CVE-2026-64642
1 advisory.
npm/next CVE-2026-64642: high
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
Action: Upgrade next to 16.2.11 or later.
npm i next@16.2.11Affected
| introduced | fixed | last affected |
|---|---|---|
| 16.0.0 | 16.2.11 | - |
Fixed versions
| 16.2.11 |
Sources
- osv: GHSA-6gpp-xcg3-4w24
- https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24
- https://github.com/vercel/next.js/pull/96014
- https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151
- https://github.com/vercel/next.js
- https://github.com/vercel/next.js/releases/tag/v16.2.11
CVE-2026-64642 · published · modified · JSON