CVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

Severity: critical (CVSS 9.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-01 · updated 2026-09-09
Weakness: CWE-22

Description

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.

Affected products

Npm Next: from 13.4.0 before 15.5.24; from 16.0.0 before 16.3.3 — fixed in 15.5.24, 16.3.3
Next.js: from 13.4.0, < 15.5.24; from 16.0.0, < 16.3.3

How to fix

Upgrade to a fixed version: Npm Next 15.5.24, 16.3.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-75604 or the next vulnerability affects your stack