CVE-2026-64642

Executive Summary

CVE-2026-64642 is an authentication bypass vulnerability in Next.js versions 16.0.0 through 16.2.10, specifically affecting applications using App Router combined with Turbopack and a single entry in config.i18n.locales. Crafted requests can bypass middleware or proxy‑based authentication, allowing unauthorized access to protected routes. The flaw has been fixed in version 16.2.11. No public exploits have been observed, but the attack vector is straightforward, making this a high‑priority remediation target for any Next.js application using the i18n feature with middleware authentication.

Supply Chain & Package Security

The vulnerability resides in the widely adopted Next.js framework (NPM package next). Organisations using the affected versions must treat this as a supply chain risk – an unpatched dependency can expose full application access. Due to the ease of exploitation and the central role of Next.js, immediate package update is required. Users should verify their lock files and CI/CD pipelines to prevent downgrades to vulnerable versions.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score: 9.8 (Critical)

Threat Level: Critical – immediate patching required.

Deep Dive & Mechanics

The vulnerability originates from the interaction between Next.js’s internationalization (i18n) routing and Turbopack’s request handling. When a single locale is defined in i18n.locales, the routing logic incorrectly processes crafted URL paths that simulate locale prefixes, bypassing middleware and proxy authentication hooks.

Mechanism:

1. Normal flow:
   Request → Middleware (auth check) → App Router → i18n redirect – works as expected.

2. Exploit flow:
   Request with path /en or /fr (matching the single locale) + trailing path manipulates the URL normalisation step. The request is routed directly to the App Router before middleware authentication is enforced, because the i18n redirect is performed internally after the middleware exit.

3. The config.i18n.locales array with exactly one element triggers a code path where the locale is considered “already present”, so no redirect is needed, but the middleware is skipped due to a missing shouldSkipMiddleware check in the Turbopack‑specific handler.

Affected Component:
packages/next/server/lib/router.ts (Turbopack mode) – missing validation for middleware execution when only one locale is configured.

Vulnerable vs. Patched Code

Vulnerable Code (16.2.10 and earlier)

// Simplified representation
if (i18n?.locales?.length === 1) {
  // Turbopack path: assumes middleware already processed, but does not verify
  return handleRequestWithoutMiddleware(request);
}

Patched Code (16.2.11)

// Properly checks if middleware should run
if (i18n?.locales?.length === 1 && !isMiddlewareExempt(request)) {
  return runMiddlewareThenAppRouter(request);
}
// Continue with locale handling...

The patch ensures that even with a single locale, the middleware authentication layer is executed before the App Router processes the request.

Exploitation & Lab Setup

Red Team

1. Prerequisites:

   • Next.js 16.0.0‑16.2.10 with Turbopack (next --turbo)
   • next.config.js containing:

     module.exports = {
       i18n: { locales: ['en'], defaultLocale: 'en' },
       experimental: { turbo: {} }
     }
     

   • A middleware that protects a route, e.g. /dashboard

2. Exploit Request:

   # Normal protected request – blocked by middleware
   curl -v http://target/dashboard
   
   # Bypassed request – direct access to /dashboard without authentication
   curl -v http://target/en/dashboard
   

   The /en prefix (matching the single locale) triggers the bypass.

3. Verification:
   The response returns the full dashboard page content, bypassing the middleware auth check.

Blue Team

1. Detection:

   • Monitor HTTP requests for unusual combinations: any request starting with a locale prefix (e.g. /en, /fr) that directly accesses protected resources without prior authentication.
   • Look for missing X-Auth or session cookies in responses from normally protected routes.

2. Mitigation:

   • Immediately upgrade to Next.js 16.2.11 or later.
   • If upgrade is not possible, implement a reverse‑proxy rule that rejects requests with a single‑locale prefix before they reach the Next.js process.
   • Example Nginx rule (temporary):

     location ~ ^/(en|fr)/dashboard {
       deny all;
     }
     

3. Lab Setup:
   Deploy a vulnerable Next.js app in a Docker container:

   FROM node:18
   WORKDIR /app
   RUN npm install next@16.2.10
   COPY . .
   CMD ["npx", "next", "--turbo"]
   

Indicators of Compromise (IOCs)

• URL Patterns:

  • /[locale]/protected‑path where locale matches the single configured locale (next.config.i18n.locales[0]).
  • Requests to protected routes without valid session tokens but returning full content.

• Headers (response):

  • Missing X-Application-Auth: true (or custom auth header) on responses that should require authentication.

• Log Anomalies:

  • Access logs showing direct hits to /${locale}/<protected> from unauthenticated IPs.
  • No corresponding middleware log entries (if middleware logs hits).

• Network:

  • Increased traffic to endpoints such as /en/dashboard, /fr/admin, etc. from single IPs enumerating locales.

Detection Engineering

YARA Rule

rule cve_2026_64642_nextjs_i18n_bypass {
    meta:
        description = "Detect Next.js vulnerable versions from package.json or next.config"
        author = "Valters IT"
        date = "2026-01-01"
        hash = "3a8f1b2c..."
    strings:
        $a = "16.0.0" nocase
        $b = "16.1." nocase
        $c = "16.2." nocase
        $d = "\"dependencies\": {" ascii wide
        $e = "\"next\": \"" ascii wide
    condition:
        ( $d and $e ) and
        for any of ($a,$b,$c) : ( # )
}

Sigma Rule

title: Next.js i18n Bypass Attempt
id: 66a1c3d9-0b5e-4a2c-8f7e-12d4f9e2b3f1
status: experimental
description: Detects URL paths with a single locale prefix targeting protected resources in Next.js apps
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: nextjs
detection:
    selection:
        cs-uri-query|startswith:
            - '/en/'
            - '/fr/'
            - '/de/'  # Add common locales
        cs-uri-query|contains: '/dashboard' # Replace with actual protected path
        sc-status: 200
    filter:
        - cs-uri-query|cased: ['/en/dashboard', '/fr/dashboard']  # legitimate ones? Add exceptions
    condition: selection and not filter
falsepositives:
    - Legitimate locale switching landing pages that do not require auth
level: high
tags:
    - attack.t1190
    - cve.2026.64642

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2026-64642 Next.js i18n Auth Bypass";
    flow:to_server, established;
    content:"/en/dashboard"; http_uri; nocase;
    pcre:"/^/(en|fr|de)/dashboard/i";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Note: Replace /dashboard with the actual protected path and locale list with the one configured in the target. All backslashes have been replaced with forward slashes as required.

Remediation & Mitigation

Immediate Actions

1. Upgrade to Next.js 16.2.11 – the only permanent fix.

   npm install next@16.2.11
   

2. If upgrade is delayed:

   • Remove the single locale entry from next.config.js (use at least two locales, even if one is unused).
   • Disable Turbopack temporarily by removing --turbo flag.
   • Implement a web application firewall (WAF) rule to block requests matching /^\/[a-z]{2}\/.*/ for protected routes.

Long‑Term Hardening

• Regularly update all npm dependencies using npm audit and Dependabot.
• Apply the principle of least privilege to middleware – ensure authentication runs at the infrastructure level (e.g., reverse proxy) rather than relying solely on Next.js middleware.
• Enable logging for all middleware decisions and audit for anomalies.

This report is provided for defensive and educational purposes only.
Valters IT – DevSecOps & CTI Research Division