CVE-2026-64642

If you're running Next.js with the i18n routing configuration and Turbopack, you need to patch. This is CVE-2026-64642, an authentication bypass that occurs when you have exactly one locale configured in your i18n setup while using the App Router with Turbopack as your bundler. The mechanism is straightforward: the single-locale code path in the i18n routing layer skips normalization logic that the multi-locale path executes. That skipped logic includes the authentication boundary enforcement that middleware is supposed to provide. Change your locales array from two entries to one, and you lose the auth check. This isn't theoretical — the patch in version 16.2.11 addresses exactly this condition. Your first action is to verify whether your deployment matches this profile. Check if you're using `i18n` in your Next.js config, have Turbopack enabled (either explicitly or as the default in recent versions), and have only one locale defined. If all three conditions are true, you are vulnerable regardless of what else your middleware does — the bypass happens before your custom auth logic even executes. The EPSS score of 0.00948 is irrelevant to your decision. This is a narrow but precise condition: either you're in the vulnerable configuration or you're not. If you are, the probability that your specific application is targeted is not 0.00948 — it's either 0 or 1 based on whether you're a worthwhile target. The narrow exploitability conditions describe your configuration profile, not the exploit's difficulty once an attacker targets you. Upgrade to 16.2.11 immediately. If you cannot upgrade, the mitigation is to either add a dummy second locale to your configuration (forcing the multi-locale code path) or migrate away from the deprecated `i18n` config object entirely to middleware-based routing — though note that the migration path itself has historically produced auth bypasses in other contexts. The safer interim step is the dummy locale workaround, which re-enables the normalized auth boundary without requiring a full routing architecture change.

Reviewed through automated stages and approved by a human before publication.