CyberRota Analysis
AI-GeneratedNext.js applications using App Router with Turbopack in versions 16.0.0 to 16.2.10 are vulnerable to authentication bypass due to improperly handled crafted requests. This vulnerability could allow unauthorized access to sensitive resources, posing a significant risk to web applications relying on this framework. Organizations utilizing affected versions should prioritize upgrading to version 16.2.11 to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue has been fixed in version 16.2.11.
Related CVEs
Other vulnerabilities affecting the same vendor(s)