What is GHSA-6gpp-xcg3-4w24?

GHSA-6gpp-xcg3-4w24 is a security advisory published by GitHub Security Advisories with High severity. Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Which CVE IDs does GHSA-6gpp-xcg3-4w24 cover?

GHSA-6gpp-xcg3-4w24 covers the following CVE IDs: CVE-2026-64642. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-6gpp-xcg3-4w24?

GHSA-6gpp-xcg3-4w24 affects 1 product, including: npm/next:\u003e= 16.0.0, \u003c 16.2.11.

GHSA-6gpp-xcg3-4w24High

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Vendor

GitHub Security Advisories

Published

July 22, 2026

Last Modified

July 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-64642 →

📋 Description

Impact

Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication.

Workarounds

If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.

🎯 Affected products1

npm/next:>= 16.0.0, < 16.2.11

🔗 References (5)

https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24
https://github.com/vercel/next.js/pull/96014
https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151
https://github.com/vercel/next.js/releases/tag/v16.2.11
https://github.com/advisories/GHSA-6gpp-xcg3-4w24