In Next.js versions 16.0.0 through 16.2.10, crafted HTTP requests can bypass middleware or proxy based authentication when the application uses the App Router with Turbopack and only a single locale is defined in the i18n configuration. The flaw allows an attacker to gain unauthorized access to protected resources, compromising confidentiality and potentially integrity. The weakness is classified as CWE‑285, an authentication bypass vulnerability.

The vulnerability affects deployments of vercel:next.js from version 16.0.0 up to but not including 16.2.11. It specifically requires the use of the App Router, Turbopack build system, and a configuration where config.i18n.locales contains only one entry.

The CVSS score of 8.3 denotes high severity. The EPSS score is less than 1%, indicating a very low exploitation probability, and the issue is not listed in the CISA KEV catalog, suggesting no known active exploits at this time. Attackers can exploit the flaw remotely by sending forged requests over the network; no local privileges or additional conditions are required. The likely attack vector is a crafted HTTP request to the application endpoint that bypasses the middleware or proxy layer.