Which versions of Red Hat are affected by EUVD-2026-49382?

A high-severity authentication bypass affecting Next.js versions 16.0.0-16.2.10 allows attackers to bypass middleware-enforced access controls in App Router applications using Turbopack with…. A patch is available.

How to fix or mitigate EUVD-2026-49382?

Within 24 hours, identify all Next.js deployments running versions 16.0.0 through 16.2.10 with Turbopack enabled and single-entry i18n.locales configurations; assess which applications rely on middleware for authentication and authorization. Within seven days, patch all affected production systems to Next.js 16.2.11 and validate that middleware matchers are correctly evaluating routes post-deployment. Within 30 days, complete patching of all remaining environments (staging, development, and any other systems) and conduct a security audit of previously protected routes to confirm no unauthorized access occurred during the vulnerability window.

Red Hat EUVD-2026-49382

Q: What is the CVSS score of EUVD-2026-49382?

EUVD-2026-49382 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.3%.

| CVE-2026-64642 HIGH

Improper Authorization (CWE-285)

2026-07-22 https://github.com/vercel/next.js

GHSA-6gpp-xcg3-4w24

Authentication Bypass Red Hat

8.3

CVSS 4.0 · Vendor: https://github.com/vercel/next.js

Severity by source

Vendor (https://github.com/vercel/next.js) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Remote unauthenticated crafted request bypasses middleware auth (AV:N/PR:N/UI:N); AC:L since exploit is a plain request, exposing protected reads and actions (C:H/I:H), no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (https://github.com/vercel/next.js).

CVSS VectorVendor: https://github.com/vercel/next.js

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 27, 2026 - 18:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 27, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

Jul 27, 2026 - 18:22 NVD

8.3 (HIGH)

Source Code Evidence Fetched

Jul 22, 2026 - 23:17 vuln.today

Analysis Generated

Jul 22, 2026 - 23:17 vuln.today

CVE Published

Jul 22, 2026 - 22:59 cve.org

HIGH

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

28 npm packages depend on next (26 direct, 2 indirect)

Ecosystem-wide dependent count for version 16.0.0.

DescriptionCVE.org

Impact

Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication.

Workarounds

If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.

AnalysisAI

Authentication bypass in Next.js App Router built with Turbopack when using a single i18n locale allows unauthenticated attackers to circumvent middleware or proxy‑based authentication via crafted requests. The vulnerability affects Next.js versions 16.0.0 through 16.2.10, and is exploitable without any user interaction. A patch is available in version 16.2.11.