CVE-2026-64642: Vercel Next.js

High severity, CVSS 8.2. EPSS: 0.6% chance of exploitation in the next 30 days.

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue has been fixed in version 16.2.11.

Affected products

• Vercel Next.js: from 16.0.0, before 16.2.11 (fixed in 16.2.11)

Published 2026-07-27. Last modified 2026-07-29.