Security vulnerabilities and automated fixes for turbopack issues
2 posts found
A critical authentication bypass vulnerability (CVE-2026-64642) was discovered in Next.js versions prior to 16.2.11, specifically affecting App Router applications using Turbopack with a single locale configuration. This vulnerability allowed attackers to bypass middleware and proxy protections, potentially gaining unauthorized access to protected routes and resources that should have been secured by authentication checks.
A critical middleware and proxy bypass vulnerability (CVE-2026-64642) was discovered in Next.js 16.0.7 when using the App Router with Turbopack and single locale configurations. This vulnerability could allow attackers to circumvent security middleware and access protected routes. The fix requires upgrading Next.js from version 16.0.7 to 16.2.11, which patches the routing logic that handles locale-based request interception.