Next.js Middleware Proxy Bypass - CVE-2026-64642 Fix

Last updated: July 2026

TL;DR

CVE-2026-64642 lets attackers bypass middleware and proxy authentication in Next.js App Router apps. It only hits builds that use Turbopack with a single entry in i18n.locales. It affects Next.js 16.0.0 through 16.2.10 - not the 15.x line. Upgrade to 16.2.11 today. If you can't upgrade right now, move your authorization checks into the page's server-side data fetching instead of relying only on middleware.

You added an auth check in middleware.ts. You tested it. Logged-out users got redirected. Logged-in users got through. Job done.

Then July 21 happened. Vercel published a Next.js middleware proxy bypass advisory nobody wanted to read at 6pm on a Tuesday.

A researcher named KarimPwnz found a way to skip that middleware check entirely. Not with a stolen token. Not with a session bug. Just a crafted request, on a specific config shape a lot of teams run without thinking twice: Turbopack build, App Router, one locale in i18n.locales.

No error. No log entry that looks wrong. The request just walks past your middleware like it isn't there.

Here's exactly what triggers it, how to check if you're exposed, and what to do today - even if you can't deploy right now.

What CVE-2026-64642 Actually Bypasses

The vulnerability in one sentence

Crafted requests to a Next.js App Router app can skip any authorization check that lives in middleware or a proxy in front of it - if that app is built with Turbopack and configured with exactly one entry in i18n.locales.

That "any" is the part that stings. It doesn't matter how careful your middleware logic is. The request never reaches it in the vulnerable path.

Why middleware-based auth breaks this way

Middleware in Next.js runs on a routing layer. It decides whether a request continues to your page or gets redirected. Most teams put session checks, role checks, or feature-flag gates here.

The bug sits in how that routing layer resolves a request when Turbopack builds it with a single-locale i18n config. The request matching logic treats the request differently than your middleware expects. Auth logic never fires. The request reaches the page anyway.

Severity and CVSS

GitHub Security Advisory GHSA-6gpp-xcg3-4w24 rates this High, CVSS 8.3. Attack vector is network. No privileges needed. No user interaction needed. That's about as easy as an authorization bypass gets.

The Exact Vulnerable Config

Turbopack + single locale i18n

Two conditions have to both be true:

1. Your app builds with Turbopack (the default builder in newer Next.js 16.x setups)

2. Your next.config.js has an i18n block with exactly one locale

What the vulnerable config looks like

javascript

// next.config.js - Vulnerable pattern
module.exports = {
  i18n: {
    locales: ['en'],
    defaultLocale: 'en',
  },
};

Nothing here looks dangerous. A single-language app with a leftover i18n block is one of the most common configs in production. That's exactly why this CVE affects "an enormous share of production Next.js apps" rather than an edge case.

What "single locale" means here

Two or more locales in the array doesn't trigger this specific bug. If your locales array already has ['en', 'fr'] or similar, this particular CVE doesn't apply to your app - though you should still upgrade for the other eight vulnerabilities patched in the same release.

Check If Your App Is Affected

Run these three checks before you touch any code.

1. Confirm your Next.js version

bash

npm ls next

or, for a fuller picture:

bash

npx next info

You're only in scope for CVE-2026-64642 if you're on Next.js 16.0.0 through 16.2.10. The 15.x line is not affected by this specific CVE.

2. Confirm you're on Turbopack

Check your package.json build script. If it includes next build --turbopack, or you're on a Next.js 16.x version where Turbopack is the default builder, you meet condition one.

3. Confirm your i18n config

Open next.config.js and look for the i18n key. Count the entries in locales. One entry means you meet condition two, and you're exposed.

If both conditions are true and you're in the 16.0.0-16.2.10 range, treat this as urgent.

Upgrade Now

Next.js 16.x line

bash

npm install next@16.2.11

16.2.11 is the patched version for this CVE and the other eight vulnerabilities in the same July 2026 release. Redeploy after upgrading - the patch does nothing sitting in your lockfile.

Do you need to move off 15.x?

Not for this CVE specifically - the advisory's affected range is 16.0.0 up to but not including 16.2.11. But the same July release patched eight other issues, some of which do touch the 15.x line. If you're on 15.x, upgrade to 15.5.21 anyway:

bash

npm install next@15.5.21

After upgrading

Rebuild and redeploy. Then re-run npx next info to confirm the installed version actually matches what you expect - a stale lockfile or a cached build image is a common reason teams think they've patched when they haven't.

Can't Upgrade Today? The Interim Fix

Some teams can't ship same-day. A regression freeze, a big release window, a monorepo with a slow CI pipeline - reasonable reasons all exist.

Move authorization into the data path

Vercel's own advisory gives the workaround directly: enforce authorization in the page's server-side data-fetching, not solely in middleware.

In practice, that means adding the check where you fetch data for the page, not just at the routing layer:

javascript

// app/dashboard/page.jsx - Correct: auth check inside the server component
import { getSession } from '@/lib/auth';
import { redirect } from 'next/navigation';

export default async function DashboardPage() {
  const session = await getSession();

  if (!session) {
    redirect('/login');
  }

  const data = await getDashboardData(session.userId);
  return <Dashboard data={data} />;
}

This check runs inside the page's own request lifecycle. It doesn't depend on the routing layer that the CVE affects. Even if a crafted request slips past middleware, it still hits this check before any data renders.

What this doesn't fix

This is a mitigation, not a patch. It closes the specific hole for pages where you add it. It does nothing for the underlying routing bug, and it's easy to miss a page. Treat it as a stopgap measured in days, not a replacement for upgrading.

For teams that hit build errors after upgrading, the Next.js build fails on Vercel post covers the most common causes of a broken deploy right after a version bump - the same environment variable and cache issues apply here.

This Is the Third Middleware Bypass in 2026

A pattern, not a one-off

This isn't Next.js's first middleware authorization bypass. A similar class of bug (CVE-2025-29927) hit in early 2025. Two more middleware or proxy-bypass CVEs have landed in 2026 alone before this one. Three incidents in the same feature area in under two years is a pattern, not bad luck.

What to change about how you write auth checks

The lesson isn't "Next.js middleware is broken." It's that middleware is a routing-layer optimization, not a security boundary you should rely on alone. If a check needs to actually hold, put it in the code path that touches the data - the pattern shown above. Middleware can still redirect early for UX. It shouldn't be the only gate.

If your app's routing setup has been fragile before, the Next.js App Router not working post covers the more common routing misconfigurations worth ruling out while you're already in this code.

Key Takeaways

• CVE-2026-64642 is a Next.js middleware proxy bypass affecting App Router apps built with Turbopack and a single-locale i18n.locales config

• It only affects Next.js 16.0.0 through 16.2.10 - not the 15.x line

• Patched version is 16.2.11, released July 21, 2026 alongside eight other CVEs

• Run npx next info to confirm your exact version before assuming you're safe or exposed

• If you can't upgrade today, move authorization checks into the page's server-side data fetching, not just middleware

• This is the third Next.js middleware or proxy-bypass CVE in 2026 - middleware alone is not a security boundary

• Two or more locales in your i18n config means this specific CVE doesn't apply, but you should still patch for the other eight

FAQ

• Does CVE-2026-64642 affect Next.js 15.x?

  No. The GitHub advisory lists the affected range as 16.0.0 up to but not including 16.2.11. The 15.x line has its own patched version, 15.5.21, for the other issues in the same release, but not this specific bypass.

• What exactly triggers this middleware bypass?

  An App Router application built with Turbopack, combined with exactly one entry in the i18n.locales array in next.config.js. Both conditions need to be true.

• Do I need Turbopack specifically, or does webpack also have this issue?

  The advisory names Turbopack builds as the trigger condition. If your app builds with webpack instead, this specific CVE doesn't apply to you.

• What if I have more than one locale configured?

  Then this specific CVE doesn't affect your app. Multiple locales in the locales array sidestep the exact condition that triggers the bug.

• Can I mitigate this without upgrading?

  Yes, as a stopgap. Move authorization checks into the page's server-side data fetching instead of relying only on middleware. Upgrade as soon as you reasonably can - this isn't a permanent fix.

• Is this the same as CVE-2025-29927?

  No, it's a separate vulnerability, but it's the same category: a middleware-based authorization bypass. This is the third such issue in Next.js during 2026.

• What other CVEs shipped in the July 2026 release?

  Eight others, covering SSRF in rewrites and Server Actions, denial-of-service issues in the Image Optimization API and Edge runtime, and cache confusion bugs affecting cached fetch() responses. All are patched in 15.5.21 and 16.2.11.

• Does hosting on Vercel or Netlify protect me automatically?

  No, not for this one. Both platforms' own advisories note that sites are affected if they use the vulnerable build and config pattern. Hosting does not patch your application code - you still need to upgrade Next.js and redeploy.

Conclusion

Middleware-based auth checks assume every request reaches them first. CVE-2026-64642 breaks that assumption for one specific, common config shape. The fix is a version bump, and the interim mitigation is one code change away if you can't ship today.

This is the third middleware bypass in Next.js this year. The real fix isn't just patching this one CVE. It's putting your important authorization checks where the data actually gets fetched, not only at the routing layer.

Patch today if you're on 16.0.0-16.2.10 with Turbopack and a single locale. Check the config either way.