CVE-2026-64642

ADVISORY - github

Summary

Impact

Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication.

Workarounds

If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.

EPSS Score⁠: 0.01009 (0.605)

Common Weakness Enumeration (CWE)

ADVISORY - github

CWE-285⁠

Improper Authorization

ADVISORY - redhat

CWE-807⁠

Reliance on Untrusted Inputs in a Security Decision

Impacted images

Advisories

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.