Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-27T17:45:40 next: Next.js: Authentication bypass leading to unauthorized access 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CWE-807

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue has been fixed in version 16.2.11.

A flaw was found in Next.js, a React framework. A remote attacker can bypass authentication in Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales by sending crafted requests. This vulnerability allows for unauthorized access, leading to a high impact on confidentiality through information disclosure.

Important: A flaw in Next.js applications, when specifically configured with App Router, Turbopack, and a single internationalization locale entry, allows for authentication bypass. This could enable unauthorized access to web applications utilizing such a configuration within Red Hat products. Cryostat 4 Affected i18next Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/backend-rhel8 Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/system-rhel7 Red Hat AMQ Broker 7 Not affected i18next Red Hat build of Apache Camel 4 for Quarkus 3 Affected quarkus-websockets-next-spi Red Hat build of Apache Camel for Spring Boot 4 Not affected i18next Red Hat build of Apache Camel - HawtIO 4 Not affected quarkus-websockets-next-spi Red Hat build of Apicurio Registry 3 Affected quarkus-websockets-next-spi Red Hat Build of Keycloak Affected quarkus-websockets-next-spi Red Hat build of Quarkus Affected quarkus-websockets-next-deployment Red Hat Ceph Storage 5 Affected rhceph/rhceph-5-dashboard-rhel8 Red Hat Ceph Storage 6 Affected rhceph/rhceph-6-dashboard-rhel9 Red Hat Ceph Storage 7 Affected rhceph/grafana-rhel9 Red Hat Ceph Storage 8 Affected rhceph/grafana-rhel9 Red Hat Ceph Storage 9 Affected rhceph/alloy-rhel10 Red Hat Connectivity Link 1 Affected rhcl-1/rhcl-console-plugin-rhel9 Red Hat Data Grid 8 Affected i18next Red Hat Enterprise Linux 10 Affected firefox Red Hat Enterprise Linux 10 Affected thunderbird Red Hat Enterprise Linux 7 Affected firefox Red Hat Enterprise Linux 8 Affected firefox Red Hat Enterprise Linux 8 Affected thunderbird Red Hat Enterprise Linux 9 Affected firefox Red Hat Enterprise Linux 9 Affected thunderbird Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/disk-image-cuda-rhel9 Red Hat JBoss Enterprise Application Platform 7 Fix deferred process-nextick-args Red Hat JBoss Enterprise Application Platform 8 Not affected i18next Red Hat Openshift Data Foundation 4 Not affected odf4/mcg-core-rhel9 Red Hat Single Sign-On 7 Fix deferred process-nextick-args Red Hat Trusted Artifact Signer Not affected rhtas/rekor-search-ui-rhel9 streams for Apache Kafka 2 Not affected next streams for Apache Kafka 3 Not affected next https://www.cve.org/CVERecord?id=CVE-2026-64642 https://nvd.nist.gov/vuln/detail/CVE-2026-64642 https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151 https://github.com/vercel/next.js/pull/96014 https://github.com/vercel/next.js/releases/tag/v16.2.11 https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24