highCVE-2026-64642Jul 22, 2026

CVE-2026-64642: Next.js Middleware Bypass via Turbopack Single-Locale i18n

Rohit Hatagale
AI Security Researcher, SecureLayer7

A flaw in how Next.js Turbopack compiles the middleware route matcher when only one locale is configured lets an attacker prefix any protected path with that locale to skip authentication entirely.

Packagenext
Ecosystemnpm
Affected>= 16.0.0, < 16.2.11
Fixed in16.2.11

The problem

Next.js App Router applications built with Turbopack that set exactly one entry in config.i18n.locales are vulnerable. Turbopack's middleware matcher fails to match locale-prefixed request paths when the locale array has only a single entry, so those requests never pass through middleware.ts.

Any route protected solely by middleware (authentication, authorization, redirect to login) can be reached without triggering that middleware. An unauthenticated attacker with network access needs only to prepend the configured locale to the path.

Proof of concept

A working proof-of-concept for CVE-2026-64642 in next, with the exact payload below.

http
# Assume the app has next.config.js:
# i18n: { locales: ['en'], defaultLocale: 'en' }
# and middleware.ts blocks unauthenticated access to /dashboard

# Normal request — middleware fires, redirects to /login:
GET /dashboard HTTP/1.1
Host: target.example.com

# Bypass — Turbopack matcher misses the locale-prefixed variant:
GET /en/dashboard HTTP/1.1
Host: target.example.com

Turbopack's compiled middleware matcher generates a route-match condition from the i18n locale list. When the list contains exactly one entry, the generated condition has an off-by-one or empty-set bug: the single locale prefix path is excluded from the set of paths the matcher tests, so the middleware function is never invoked for requests starting with /<locale>/.

This is a Turbopack-only regression. Webpack builds produce a correct matcher that covers all locale-prefixed paths regardless of list length. The patch in PR #96014 (commit 6bf4df1) corrects the single-locale edge case in Turbopack's matcher codegen, aligning its output with the webpack path.

CWE-285 (Improper Authorization) applies because the access-control gate is silently skipped rather than explicitly defeated.

The fix

Upgrade next to **16.2.11** or later. If you cannot upgrade immediately, enforce authorization inside server-side data-fetching (e.g., cookies() / headers() checks in a Server Component or Route Handler) rather than relying on middleware alone. Alternatively, switch from Turbopack (next dev --turbopack) to the webpack bundler until the patch is applied.

Reported by KarimPwnz.

References: [1][2][3][4][5]

Related research