Middleware/proxy authentication bypass in Next.js App Router with Turbopack (CVE-2026-64642)

Next.js applications using App Router built with Turbopack and a single entry in `config.i18n.locales` are vulnerable to authentication bypass via crafted requests. An unauthenticated remote attacker can circumvent middleware- and proxy-based authentication controls, resulting in high confidentiality impact and low integrity impact. Affected versions: - >= 16.0.0 < 16.2.11 We recommend updating to: 16.2.11. CVSS 8.3 · our assessment: this_week Reference: https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24 Details: https://vuln.today/cve/CVE-2026-64642