Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue has been fixed in version 16.2.11.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10,
    crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry
    in config.i18n.locales can bypass middleware/proxy based authentication. This issue has been fixed in
    version 16.2.11. (CVE-2026-64642)

The Next.js Framework on the remote host is affected by an authentication bypass vulnerability:

  - Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry     in config.i18n.locales can bypass middleware/proxy based authentication. (CVE-2026-64642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
465002	Echo: next: security update to 16.2.11	Tenable Cloud Security	Echo Local Security Checks	Local	high
465002	Echo: next: security update to 16.2.11	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
330087	Next.js Framework 16.x < 16.2.11 Middleware Bypass	Nessus	Misc.	Local	high
445138	SCA: security update for next (GHSA-6gpp-xcg3-4w24)	Tenable Cloud Security	SCA Checks	Local	high
445138	SCA: security update for next (GHSA-6gpp-xcg3-4w24)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-64642

high

Tenable Plugins

high

high

high

high

high