CVE-2026-64642

A flaw was found in Next.js, a React framework. A remote attacker can bypass authentication in Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales by sending crafted requests. This vulnerability allows for unauthorized access, leading to a high impact on confidentiality through information disclosure.

Important: A flaw in Next.js applications, when specifically configured with App Router, Turbopack, and a single internationalization locale entry, allows for authentication bypass. This could enable unauthorized access to web applications utilizing such a configuration within Red Hat products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.