Summary
Next.js applications using the App Router with Turbopack and a single i18n locale can allow crafted HTTP requests to bypass middleware or proxy-based authentication.
Under these conditions, an attacker may reach protected routes without valid credentials, turning what should be gated functionality into a publicly accessible attack surface.
Next.js applications using the App Router with Turbopack and a single i18n locale can allow crafted HTTP requests to bypass middleware or proxy-based authentication.
Under these conditions, an attacker may reach protected routes without valid credentials, turning what should be gated functionality into a publicly accessible attack surface.
Affected context
This vulnerability manifests in Next.js deployments that:
- Use the App Router with Turbopack as the bundler/runtime,
- Configure internationalization with exactly one entry in
config.i18n.locales, - Rely on middleware or upstream proxies to enforce authentication and route protection.
In such setups, URL normalization and routing behavior around i18n and Turbopack can cause certain requests to skip expected auth checks, depending on how middleware and proxies are integrated.
This vulnerability manifests in Next.js deployments that:
- Use the App Router with Turbopack as the bundler/runtime,
- Configure internationalization with exactly one entry in
config.i18n.locales, - Rely on middleware or upstream proxies to enforce authentication and route protection.
In such setups, URL normalization and routing behavior around i18n and Turbopack can cause certain requests to skip expected auth checks, depending on how middleware and proxies are integrated.
Exploit preconditions
- Attack surface: Public HTTP endpoints exposed by a Next.js App Router application.
- Required access: Network access to the affected application (no prior authentication needed).
- Trigger point: Specifically crafted requests that interact with i18n-aware routing under Turbopack, in a configuration with a single locale.
- Why exploitation is possible: Middleware/proxy-based authentication relies on consistent routing and path handling; under the described i18n/Turbopack configuration, some requests are routed in a way that bypasses the middleware or proxy's enforcement logic.
- Attack surface: Public HTTP endpoints exposed by a Next.js App Router application.
- Required access: Network access to the affected application (no prior authentication needed).
- Trigger point: Specifically crafted requests that interact with i18n-aware routing under Turbopack, in a configuration with a single locale.
- Why exploitation is possible: Middleware/proxy-based authentication relies on consistent routing and path handling; under the described i18n/Turbopack configuration, some requests are routed in a way that bypasses the middleware or proxy's enforcement logic.
Why this happens
The underlying issue aligns with CWE-285: Improper Authorization and stems from a mismatch between routing behavior and the assumed enforcement of authentication.
When App Router, Turbopack, and single-locale i18n are combined, certain paths or request variants are handled differently than expected, resulting in middleware or proxy chains not being applied uniformly.
This abstractly reflects an authorization boundary implemented in one layer (middleware/proxy) that is not consistently invoked for all effective routes in the application, leaving gaps in access control coverage.
The underlying issue aligns with CWE-285: Improper Authorization and stems from a mismatch between routing behavior and the assumed enforcement of authentication.
When App Router, Turbopack, and single-locale i18n are combined, certain paths or request variants are handled differently than expected, resulting in middleware or proxy chains not being applied uniformly.
This abstractly reflects an authorization boundary implemented in one layer (middleware/proxy) that is not consistently invoked for all effective routes in the application, leaving gaps in access control coverage.
Potential impact
- Attackers may access routes that are intended to be authenticated-only.
- Sensitive data can be exposed through APIs or pages that are assumed to be protected.
- Unauthorized state-changing operations (e.g., updates, deletions) could be performed via protected endpoints.
- Application-level security policies based on middleware or proxies can be systematically bypassed.
- Attackers may access routes that are intended to be authenticated-only.
- Sensitive data can be exposed through APIs or pages that are assumed to be protected.
- Unauthorized state-changing operations (e.g., updates, deletions) could be performed via protected endpoints.
- Application-level security policies based on middleware or proxies can be systematically bypassed.
General mitigation guidance
Mitigation focuses on strengthening and centralizing authorization boundaries rather than relying solely on middleware or proxies that can be bypassed by routing nuances.
Recommended patterns include:
- Implementing authorization checks at the business logic or handler level (e.g., inside server components, route handlers, or controllers) so that every code path performing sensitive operations validates identity and permissions.
- Designing routing and i18n configurations so that all externally reachable paths pass through the same, well-defined access control layer.
- Avoiding assumptions that single-locale or special-case routing configurations are neutral to authentication; instead, validate that every route variant is covered by auth logic.
- Applying least privilege principles to downstream services and APIs so that even if a route is exposed unintentionally, its ability to perform sensitive actions is limited.
Mitigation focuses on strengthening and centralizing authorization boundaries rather than relying solely on middleware or proxies that can be bypassed by routing nuances.
Recommended patterns include:
- Implementing authorization checks at the business logic or handler level (e.g., inside server components, route handlers, or controllers) so that every code path performing sensitive operations validates identity and permissions.
- Designing routing and i18n configurations so that all externally reachable paths pass through the same, well-defined access control layer.
- Avoiding assumptions that single-locale or special-case routing configurations are neutral to authentication; instead, validate that every route variant is covered by auth logic.
- Applying least privilege principles to downstream services and APIs so that even if a route is exposed unintentionally, its ability to perform sensitive actions is limited.
How teams detect issues like this
Detection typically involves reviewing both configuration and code for authorization consistency:
- Static analysis or manual code review to ensure that sensitive route handlers and APIs contain explicit authorization checks, independent of middleware or proxy assumptions.
- Configuration review of i18n and Turbopack setups to identify single-locale or special routing cases that might skip middleware chains.
- Security testing and fuzzing of route variants (including localized paths and edge cases) to confirm that all effective routes enforce authentication.
- Policy-based checks in CI/CD that flag endpoints marked as "protected" but lacking in-handler authorization logic or being reachable via alternate unauthenticated paths.
Detection typically involves reviewing both configuration and code for authorization consistency:
- Static analysis or manual code review to ensure that sensitive route handlers and APIs contain explicit authorization checks, independent of middleware or proxy assumptions.
- Configuration review of i18n and Turbopack setups to identify single-locale or special routing cases that might skip middleware chains.
- Security testing and fuzzing of route variants (including localized paths and edge cases) to confirm that all effective routes enforce authentication.
- Policy-based checks in CI/CD that flag endpoints marked as "protected" but lacking in-handler authorization logic or being reachable via alternate unauthenticated paths.
