CVE-2026-64642
ADVISORY - githubSummary
Impact
Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication.
Workarounds
If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.
EPSS Score: 0.01009 (0.605)
Common Weakness Enumeration (CWE)
ADVISORY - github
Improper Authorization
ADVISORY - redhat
Reliance on Untrusted Inputs in a Security Decision
GitHub
CREATED
UPDATED
ADVISORY IDGHSA-6gpp-xcg3-4w24
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
CVSS SCORE
8.3highRed Hat
CREATED
UPDATED
ADVISORY IDCVE-2026-64642
EXPLOITABILITY SCORE
3.9
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
CVSS SCORE
8.2highChainguard
CREATED
UPDATED
ADVISORY ID
CGA-2j5c-c45p-994c
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
minimos
CREATED
UPDATED
ADVISORY ID
MINI-9wvx-hc9f-6c35
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
minimos
CREATED
UPDATED
ADVISORY ID
MINI-c8h8-whv8-5rf4
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
minimos
CREATED
UPDATED
ADVISORY ID
MINI-r544-fxcq-2cxj
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-