CVE-2026-64642

score

0.1

cvss

8.2

epss

0.6%

published

2026-07-27

kev added

—

first seen

2026-10-21

Next.js 16.0.0 through 16.2.10 contains an authentication bypass caused by crafted requests targeting App Router with Turbopack and single entry in config.i18n.locales, letting attackers bypass middleware/proxy authentication, exploit requires specific config and request crafting.