Authentication Bypass in Next.js Framework Versions Affected by Vercel

CVE-2026-64642

What is CVE-2026-64642?

In the Next.js framework, versions 16.0.0 through 16.2.10 are susceptible to an authentication bypass vulnerability. This flaw can be exploited through crafted requests aimed at Next.js applications utilizing the App Router with a singular configuration entry in config.i18n.locales. Successful exploitation permits circumvention of middleware or proxy authentication mechanisms, potentially allowing unauthorized access to application resources. The vulnerability has been addressed in Next.js version 16.2.11, which users are encouraged to upgrade to in order to maintain the security integrity of their applications.

References