GHSA-p293-qw3h-jr36: Path Traversal

Q: Which deployments are exposed?

Applications using Next.js Pages Router and App Router without Cache Component are affected when their server is hosted on a machine using a Windows filesystem.

Q: What access does an attacker need?

The advisory rates the issue as network-accessible with no privileges or user interaction required. Exploitation is assessed as high complexity.

Q: What should teams do if they cannot patch immediately?

No workaround is known for affected applications hosted on Windows. The stated remediation is to upgrade immediately.

Published Sep 8, 2026

Updated

Impact

A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.

Workaround

There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows.

Affected Software

2 affected componentsFixes available

npm/next>=16.0.0<16.3.3

16.3.3

npm/next>=13.4.0<15.5.24

15.5.24

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/next to a version that resolves this vulnerability.
Fixed in 16.3.3
Upgrade
Upgrade npm/next to a version that resolves this vulnerability.
Fixed in 15.5.24

Event History

Sep 8, 2026

Advisory Published

via GitHub·08:51 PM

Data Sourced

via GitHub·08:51 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed?

Applications using Next.js Pages Router and App Router without Cache Component are affected when their server is hosted on a machine using a Windows filesystem.

What access does an attacker need?