CVE-2026-64642 in Next.js 16.1.1

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Severity

High 8.3

Exploitation

1% chance of exploit
in the next 30 days

Fix

Update to 16.2.11

Where

App / API

How it matched

Exact version match

Also known as

GHSA-6gpp-xcg3-4w24

First seen

2026-11-05 01:13:58 UTC

Source

https://osv.dev/vulnerability/GHSA-6gpp-xcg3-4w24