How Middleware/Proxy Bypass Happens in Next.js App Router with Turbopack and Single Locale and How to Fix It

How Middleware/Proxy Bypass Happens in Next.js App Router with Turbopack and Single Locale and How to Fix It

Understanding the Vulnerability

In Next.js applications using the App Router with Turbopack bundler and single locale configurations, a critical security flaw existed in versions 16.0.7 and earlier. This vulnerability (CVE-2026-64642) allowed attackers to bypass middleware guards and proxy rules, potentially gaining unauthorized access to protected routes and sensitive data.

The issue wasn't in your application code—it was in Next.js's internal request routing engine. When Turbopack processed requests in a single-locale setup, it failed to properly invoke middleware for certain request patterns, creating a window of opportunity for attackers to access resources that should have been protected.

The Root Cause: How the Vulnerability Works

Next.js middleware is designed to run before your application code executes. It's the first line of defense for authentication, authorization, rate limiting, and other security controls. In your middleware, you might have code like this:

// middleware.ts
import { NextRequest, NextResponse } from 'next/server';

export function middleware(request: NextRequest) {
  // Check if user is authenticated
  const token = request.cookies.get('auth-token');

  if (!token) {
    return NextResponse.redirect(new URL('/login', request.url));
  }

  return NextResponse.next();
}

export const config = {
  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
};

This middleware should protect all routes. However, in Next.js 16.0.7 with Turbopack and single locale configuration, the request routing engine had a flaw in how it matched routes before invoking middleware. Specifically:

1. Request interception logic: Turbopack's route matching engine would process locale-prefixed requests
2. Middleware enforcement gap: For certain request patterns in single-locale setups, the engine would skip middleware invocation
3. Direct route access: Attackers could craft requests that bypassed the matcher entirely, accessing protected routes without authentication

The vulnerability existed in the pnpm-lock.yaml dependency tree because Next.js 16.0.7 contained the buggy routing logic. The Vercel Analytics integration and next-intl internationalization library both depend on Next.js's core routing, making them affected by this flaw.

Attack Scenario

Consider a typical e-commerce application:

GET /api/admin/users → Protected by middleware (requires admin token)
GET /admin/dashboard → Protected by middleware (requires admin token)

With the CVE-2026-64642 vulnerability, an attacker could potentially craft a request that bypassed middleware:

GET /api/admin/users?locale=en  
// Middleware might not invoke due to locale parameter handling in Turbopack
// Application receives request without authentication check
// Attacker gains access to sensitive user data

In a single-locale configuration (where your app only serves one language), Turbopack's optimization logic incorrectly assumed certain request patterns didn't need middleware re-evaluation, creating the bypass.

The Fix: Upgrading Next.js

The security patch was released in Next.js 16.2.11. The fix involved correcting the request interception logic in Turbopack's route matching engine to ensure middleware is always invoked before application code executes, regardless of locale configuration or request parameters.

Here's what changed in your project:

Before (Vulnerable):

{
  "dependencies": {
    "next": "16.0.7",
    "next-intl": "^4.5.0",
    "@vercel/analytics": "^1.5.0"
  }
}

After (Patched):

{
  "dependencies": {
    "next": "16.2.11",
    "next-intl": "^4.5.0",
    "@vercel/analytics": "^1.5.0"
  }
}

The lock file updates reflect that Next.js 16.2.11 is now installed:

# Before
next:
  specifier: 16.0.7
  version: 16.0.7(@babel/core@7.28.5)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)

# After
next:
  specifier: 16.2.11
  version: 16.2.11(@babel/core@7.28.5)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)

All dependent packages (next-intl, @vercel/analytics) are automatically updated to use the patched Next.js version.

What Changed in Next.js 16.2.11

While the exact internal changes aren't detailed in this PR, the fix addresses:

1. Middleware invocation guarantee: The routing engine now ensures middleware runs for all requests, including those with locale parameters
2. Turbopack route matching: Corrected the optimization logic that was incorrectly skipping middleware for single-locale configurations
3. Request interception: Fixed the layer between the HTTP handler and application code to never bypass middleware guards

Why This Matters for Your App

If your Next.js application uses:
- App Router (not Pages Router)
- Turbopack bundler (for faster local development)
- Single locale configuration (or even multi-locale with certain setups)
- Middleware for authentication or authorization

...then you were vulnerable to this bypass. Any attacker could potentially:
- Access protected admin panels without authentication
- Retrieve sensitive API data
- Modify resources they shouldn't have permission to touch
- Bypass rate limiting or other security controls

How to Verify the Fix

After upgrading to Next.js 16.2.11, verify the fix:

# Update dependencies
pnpm install

# Check the installed version
pnpm list next
# Should show: next@16.2.11

# Test your middleware
npm run dev

# In another terminal, test a protected route
curl -i http://localhost:3000/api/admin/users
# Should be redirected to /login or return 401 Unauthorized
# NOT return 200 with data

Prevention & Best Practices

1. Keep Next.js Updated
- Subscribe to Next.js security advisories: https://github.com/vercel/next.js/security/advisories
- Update to patch versions promptly (16.0.7 → 16.2.11)
- Use tools like Dependabot to automate dependency updates

2. Test Middleware Thoroughly

// middleware.test.ts
import { middleware } from './middleware';
import { NextRequest } from 'next/server';

describe('Middleware Security', () => {
  test('should reject unauthenticated requests', () => {
    const request = new NextRequest(new URL('http://localhost:3000/api/admin'));
    const response = middleware(request);
    expect(response.status).toBe(307); // Redirect to login
  });

  test('should reject requests with missing auth token', () => {
    const request = new NextRequest(new URL('http://localhost:3000/api/admin?locale=en'));
    const response = middleware(request);
    expect(response.status).toBe(307);
  });
});

3. Use Comprehensive Matcher Patterns

export const config = {
  matcher: [
    // Protect all API routes
    '/api/:path*',
    // Protect admin routes
    '/admin/:path*',
    // Explicitly include locale variants
    '/(en|es|fr)/api/:path*',
  ],
};

4. Implement Defense in Depth
Don't rely solely on middleware. Add authentication checks at the API route level too:

// app/api/admin/users/route.ts
import { verifyAuth } from '@/lib/auth';

export async function GET(request: Request) {
  // Middleware should have already checked, but verify again
  const user = await verifyAuth(request);
  if (!user?.isAdmin) {
    return Response.json({ error: 'Unauthorized' }, { status: 401 });
  }

  return Response.json({ users: [] });
}

5. Use Dependency Scanning Tools
- Trivy: Scans for known vulnerabilities in dependencies (detected this CVE)
- npm audit: Built-in vulnerability scanner
- Snyk: Comprehensive dependency scanning
- OWASP Dependency-Check: Open-source tool

Key Takeaways

• Turbopack's single-locale optimization had a bug: The route matching engine incorrectly skipped middleware invocation for certain request patterns, creating a bypass vector
• Upgrade immediately: CVE-2026-64642 is HIGH severity and affects all Next.js 16.0.x users with App Router + Turbopack + single locale
• Dependency scanning caught this: Trivy's CVE-2026-64642 rule detected the vulnerable Next.js version in your lock file
• Always verify middleware executes: Test that authentication checks run for all request paths, including those with query parameters or locale prefixes
• Defense in depth is essential: Don't trust middleware alone—add authorization checks at the route handler level too

How Orbis AppSec Detected This

Source: The vulnerable Next.js version (16.0.7) in package.json and pnpm-lock.yaml dependency tree

Sink: Next.js's internal request routing engine in Turbopack's route matching logic, which handles middleware invocation for App Router applications

Missing control: The routing engine lacked proper validation to ensure middleware always executes before route handlers, particularly for single-locale configurations with Turbopack

CWE: CWE-863 (Incorrect Authorization) and CWE-941 (Incorrectly Specified Initialization with Hard-Coded Network Resource Configuration Data)

Fix: Upgrade Next.js from 16.0.7 to 16.2.11, which patches the request interception and middleware enforcement logic in Turbopack's routing engine

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

CVE-2026-64642 demonstrates a critical principle in web security: framework bugs can bypass application-level security controls. Even if your middleware code is perfect, a flaw in the framework's request routing can render it ineffective.

The good news is that Vercel released a patch quickly, and upgrading is straightforward. By updating to Next.js 16.2.11, you ensure that:

1. Middleware always runs before application code
2. Attackers cannot bypass authentication or authorization checks through request manipulation
3. Your application's security posture is restored

Make this upgrade a priority in your Next.js projects, especially if you're using App Router with Turbopack. And remember: keep your dependencies updated. Security patches like this are released for a reason.

References

• CVE-2026-64642 - NVD Entry
• CWE-863: Incorrect Authorization
• CWE-941: Incorrectly Specified Initialization with Hard-Coded Network Resource Configuration Data
• Next.js Middleware Documentation
• Next.js Security Advisories
• OWASP Authorization Cheat Sheet
• Trivy Vulnerability Scanner
• GitHub PR: fix: upgrade next to 16.2.11 (CVE-2026-64642)