CVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 15.5.24 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 16.3.3
Event History
Frequently Asked Questions
Which deployments are exposed?
The issue affects Next.js applications hosted on Windows that use either the Pages Router or the App Router without Cache Components. Versions from 13.4.0 through 15.5.23 are affected, as are 16.x versions before 16.3.3.
What does an attacker need to exploit this?
An attacker can send a remote request containing encoded Windows path separators in route segments. No authentication or user interaction is required, although the attack complexity is rated high.
Why can a cache-path traversal lead to code execution?
Traversal outside the intended incremental-cache root can disclose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application.
What versions remediate the issue?
Update to Next.js 15.5.24 or 16.3.3. These versions contain the fix for the inconsistent escaping of backslashes in route segments.