Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue has been fixed in version 16.2.11.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-23 | 1 | Patch1 |
| 2026-07-27 | 1 | Disclosure1 |
Three Next.js vulnerabilities (CVE-2026-64645, CVE-2026-64649, CVE-2026-64642) enable Server-Side Request Forgery and middleware bypass. Patch now. #Nextjs #SSRF #CVE202664645 #WebSecurity #Vercel http://securityonline.info/nextjs-vulnerabilities-ssrf/
Post summary
A recent disclosure of three Next.js SSRF vulnerabilities (CVE‑2026‑64645, 64649, 64642) that enable middleware bypass, with an available vendor patch.
CVE-2026-64642 Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App R… https://www.cve.org/CVERecord?id=CVE-2026-64642
Post summary
The excerpt references a newly disclosed CVE affecting specific Next.js releases, but lacks detailed technical info, PoC evidence, or exploitation claims.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vercel | next.js | - | node.js | - |