MSRXCVE-2026-75604
CVE-2026-75604
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
CVSS 3.1 · CNA
chance of exploitation in the next 30 days (EPSS; higher than 81% of CVEs)
Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.
Scores
Affected packages and fixed versions
| Package | Ecosystem | Fixed in |
|---|---|---|
| next | npm | 15.5.24, 16.3.3 |
Affected products
- vercel next.js: >= 13.4.0, < 15.5.24; >= 16.0.0, < 16.3.3
Weakness: CWE-22
Also known as: GHSA-p293-qw3h-jr36
5 references (advisories, patches, write-ups)
- https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36 · x_refsource_CONFIRM
- https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b · x_refsource_MISC
- https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3 · x_refsource_MISC
- https://github.com/vercel/next.js/releases/tag/v15.5.24 · x_refsource_MISC
- https://github.com/vercel/next.js/releases/tag/v16.3.3 · x_refsource_MISC
Sources: CVE.org, OSV.dev, FIRST EPSS. Missing ones did not answer or have no record yet.