HIGH
GHSA-6gpp-xcg3-4w24
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
Quick fix
GHSA-6gpp-xcg3-4w24 — next: upgrade to the fixed version with the command below.
npm install next@16.2.11Details
## Impact
Crafted requests targeting Next.js applications using App Router built with Turbopack and a **single** entry in `config.i18n.locales` can bypass middleware/proxy based authentication.
## Workarounds
If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24 [WEB]
- https://github.com/vercel/next.js/pull/96014 [WEB]
- https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151 [WEB]
- https://github.com/vercel/next.js [PACKAGE]
- https://github.com/vercel/next.js/releases/tag/v16.2.11 [WEB]