Is CVE-2026-64642 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-64642 being exploited in the wild.

How severe is CVE-2026-64642?

High severity, with a CVSS score of 4, published 27 July 2026.

Which products and versions are affected?

next (npm) SEMVER:introduced=16.0.0,fixed=16.2.11; Vercel Next.js >= 16.0.0, < 16.2.11.

Is there a fix for CVE-2026-64642?

Yes. next (npm): upgrade to 16.2.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-64642 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-64642?

Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64642: Vercel Next.js authentication bypass in Turbopack middleware matcher

Q: Is there a fix for CVE-2026-64642?

Yes. next (npm): upgrade to 16.2.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-64642 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-64642?

Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64642 · Severity: high · CVSS 4 · Published 2026-07-27

Next.js is a popular framework used to build and deploy web applications. A security flaw in certain configurations allows attackers to bypass authentication checks performed by middleware or proxies. This could lead to unauthorized access to sensitive data or restricted areas of the application.

Technologies: next (npm), Vercel Next.js. Vendors: npm, Vercel.

Quick answers

Is CVE-2026-64642 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-64642 being exploited in the wild.
How severe is CVE-2026-64642?: High severity, with a CVSS score of 4, published 27 July 2026.
Which products and versions are affected?: next (npm) SEMVER:introduced=16.0.0,fixed=16.2.11; Vercel Next.js >= 16.0.0, < 16.2.11.
Is there a fix for CVE-2026-64642?: Yes. next (npm): upgrade to 16.2.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64642 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-64642?: Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

next (npm): upgrade to 16.2.11 or later
```
npm install next@16.2.11
```

Technical details

An improper authorization vulnerability (CWE-285) exists in Next.js versions 16.0.0 through 16.2.10. The issue occurs when an application uses the App Router built with Turbopack and has exactly one entry in the 'config.i18n.locales' configuration. In this specific environment, the Turbopack middleware matcher fails to correctly process certain crafted requests, allowing them to bypass middleware-level security checks or proxy-based authentication. Attackers can exploit this over the network without prior authentication to access restricted routes. The vulnerability is resolved in version 16.2.11 by correcting the middleware matching logic in the Turbopack implementation.

Affected products

Vercel Next.js >= 16.0.0, < 16.2.11

Identifiers

CVE-2026-64642
GHSA-6gpp-xcg3-4w24

Timeline

2026-07-21: patched: Fixed in version 16.2.11
2026-07-21: advisory: GitHub Security Advisory GHSA-6gpp-xcg3-4w24 published
2026-07-27: disclosed: CVE-2026-64642 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.