{"action":"Upgrade next to 16.2.11 or later.","affected":[{"fixed":"16.2.11","introduced":"16.0.0"}],"component":"next","cve_ids":["CVE-2026-64642"],"ecosystem":"npm","epss":0.00635,"exploited":false,"fixed_versions":["16.2.11"],"ghsa_id":"GHSA-6gpp-xcg3-4w24","id":"tcs_01M5KF70TC61Z1XFTETJS459B5","modified_at":"2026-09-10T03:51:10.700589078Z","published_at":"2026-07-22T22:59:38Z","references":["https://osv.dev/vulnerability/GHSA-6gpp-xcg3-4w24","https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24","https://github.com/vercel/next.js/pull/96014","https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151","https://github.com/vercel/next.js","https://github.com/vercel/next.js/releases/tag/v16.2.11"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-6gpp-xcg3-4w24","url":"https://osv.dev/vulnerability/GHSA-6gpp-xcg3-4w24"}],"summary":"Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale"}