How Authentication Bypass happens in Next.js App Router with Turbopack and how to fix it

Introduction

In a Next.js application using the App Router with Turbopack enabled, a critical vulnerability was discovered in the package-lock.json dependency configuration. The application was running Next.js version 16.2.10, which contained CVE-2026-64642—a high-severity authentication bypass flaw that specifically affected applications using Turbopack with single locale configurations. This vulnerability allowed attackers to circumvent middleware authentication checks and access protected routes without proper authorization, potentially exposing sensitive user data and administrative functions.

The issue was particularly insidious because it only manifested under specific conditions: when using the experimental Turbopack bundler combined with a single locale setup in the App Router. This meant that applications running the default Webpack bundler or those with multiple locales configured would not exhibit the vulnerability, making it harder to detect through standard testing procedures.

The Vulnerability Explained

CVE-2026-64642 represents a fundamental flaw in how Next.js 16.2.10 handled middleware execution in the Turbopack bundler pipeline. In the vulnerable version, the routing logic failed to properly invoke middleware functions when processing requests in applications configured with a single locale.

Here's what the vulnerable dependency looked like in package-lock.json:

"next": "^16.2.10",

The vulnerability occurred because Turbopack's routing implementation contained a logic error that caused it to skip middleware evaluation under certain conditions. When a Next.js application was configured with a single locale (or no explicit i18n configuration), the request routing path would bypass the middleware layer entirely, proceeding directly to the route handler.

How the Attack Works

Consider a typical Next.js App Router application with authentication middleware:

// middleware.ts
export function middleware(request) {
  const token = request.cookies.get('auth-token');
  if (!token || !verifyToken(token)) {
    return NextResponse.redirect(new URL('/login', request.url));
  }
}

export const config = {
  matcher: ['/dashboard/:path*', '/api/user/:path*']
};

In a properly functioning Next.js application, any request to /dashboard/* or /api/user/* would first pass through this middleware, which verifies the authentication token. However, in Next.js 16.2.10 with Turbopack and a single locale configuration, an attacker could:

1. Send a request directly to a protected route like /dashboard/admin
2. The Turbopack router would fail to invoke the middleware function
3. The request would proceed directly to the route handler
4. The attacker gains unauthorized access without authentication

This bypass was particularly dangerous because:

• Silent failure: The application appeared to work normally in development, with no error messages indicating the middleware was being skipped
• Selective impact: Only specific configurations were affected, making the vulnerability hard to detect through general testing
• Complete bypass: All middleware protections were circumvented, including authentication, authorization, rate limiting, and logging

Real-World Impact

For the application in question, which uses drizzle-orm for database operations and likely implements user authentication, this vulnerability could have allowed:

• Unauthorized access to user dashboards and profile information
• Bypassing API route protection to perform privileged operations
• Accessing administrative interfaces without proper credentials
• Circumventing rate limiting and abuse prevention middleware
• Evading audit logging that tracks user actions

The severity is amplified because the application uses React 19.2.7 and likely implements modern server-side rendering patterns, meaning sensitive data could be exposed during the initial server render before any client-side protections could activate.

The Fix

The fix for CVE-2026-64642 was straightforward but critical: upgrading Next.js from version 16.2.10 to 16.2.11. The patch was released specifically to address the middleware bypass issue in Turbopack.

Before (Vulnerable):

{
  "dependencies": {
    "next": "^16.2.10"
  }
}

After (Fixed):

{
  "dependencies": {
    "next": "^16.2.11"
  }
}

The package-lock.json changes show the version update along with additional modifications to the Sharp image optimization library's platform-specific binaries. Notably, the fix removed explicit libc constraints from multiple Sharp platform packages:

-      "libc": [
-        "glibc"
-      ],

These changes to Sharp's optional dependencies (for ARM, ARM64, PowerPC, RISC-V, s390x, and x64 architectures on both glibc and musl systems) were part of the Next.js 16.2.11 release to improve compatibility and ensure the security fix could be deployed across a wider range of deployment environments.

How the Patch Works

Next.js 16.2.11 corrected the Turbopack routing logic by:

1. Enforcing middleware execution: The router now properly checks for and invokes middleware functions regardless of locale configuration
2. Fixing the condition check: The logic that determined whether to run middleware was corrected to include single-locale scenarios
3. Validating the middleware chain: Additional validation ensures the middleware chain is properly constructed before routing proceeds

The fix ensures that every request matching the middleware matcher configuration will execute the middleware function before reaching the route handler, restoring the intended security boundary.

Key Takeaways

• Turbopack-specific vulnerability: CVE-2026-64642 only affected Next.js applications using Turbopack with single locale configurations, demonstrating the importance of testing across different bundler setups
• Middleware cannot be trusted alone: The vulnerability bypassed middleware entirely, proving that defense-in-depth with route-level and API-level authentication checks is essential
• Version 16.2.10 is critically vulnerable: Any Next.js application running version 16.2.10 with Turbopack enabled should immediately upgrade to 16.2.11 or later
• Silent failures are dangerous: The vulnerability produced no error messages or warnings, highlighting the need for comprehensive security testing and monitoring
• Dependency updates matter: The fix required only a minor version bump, but the security impact was severe—regular dependency updates are critical for security

How Orbis AppSec Detected This

• Source: The vulnerability originated in the Next.js framework's routing logic when processing HTTP requests in Turbopack-enabled applications with single locale configurations
• Sink: The middleware execution layer in next version 16.2.10, where the routing logic failed to properly invoke authentication middleware functions
• Missing control: Proper middleware invocation checks were absent in the Turbopack routing path for single-locale configurations, allowing requests to bypass authentication entirely
• CWE: CWE-287 (Improper Authentication) - the framework failed to properly authenticate users before granting access to protected resources
• Fix: Upgraded Next.js from version 16.2.10 to 16.2.11, which patches the Turbopack routing logic to correctly enforce middleware execution in all locale configurations

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

CVE-2026-64642 demonstrates how framework-level vulnerabilities can undermine application security even when developers implement proper authentication patterns. The middleware bypass in Next.js 16.2.10's Turbopack implementation allowed complete circumvention of authentication controls in applications with single locale configurations, potentially exposing sensitive data and functionality to unauthorized users.

The fix—upgrading to Next.js 16.2.11—was simple but critical. This incident reinforces several key security principles: keep dependencies updated, implement defense-in-depth authentication, test across different configurations, and use automated security scanning to detect known vulnerabilities before they reach production.

By staying vigilant about dependency updates and following security best practices, development teams can protect their applications from both known CVEs and emerging threats. Remember that security is not a single layer but a comprehensive strategy that must be maintained throughout the application lifecycle.