Skip to content
OpenAdvisories
Critical · 9.0 Public exploit CVE-2026-75604 EUVD-2026-69702GHSA-p293-qw3h-jr36

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

Published Sep 1, 2026 · Updated Sep 4, 2026 · Assigned by GitHub_M

Vendor: vercel Product: next.js Package: next Ecosystem: npm

Description

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.

Affected products

VendorProductAffectedFixed
vercel next.js >= 13.4.0, < 15.5.24, >= 16.0.0, < 16.3.3 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

GitHub 4 repositories

  • rafabd1/CVE-2026-75604-poc ★ 109 · Aug 25, 2026

    CVE-2026-75604 Next.js Windows RCE poc

  • e4zyy/Project-CVE-2026-75604 ★ 3 · Aug 27, 2026

    A Python-based exploitation framework for CVE-2026-75604 that enables authorized penetration testers to validate Next.js Windows cache traversal vulnerabilities. Deploys reverse shells and webshells …

  • HackSpeak/CVE-2026-75604 ★ 2 · Aug 26, 2026

    CVE-2026-75604 (Next.js Windows RCE) PoC - unauthenticated RCE via cache path traversal + forged Server Action; for authorized security testing

  • FORTBRIDGE-UK/cve-2026-75604 ★ 0 · Sep 3, 2026

    Research lab and exploit chain for CVE-2026-75604: path traversal in the Next.js incremental cache, to RCE on Windows.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm next >= 13.4.0, < 15.5.24 15.5.24 GHSA-p293-qw3h-jr36
npm next >= 16.0.0, < 16.3.3 16.3.3 GHSA-p293-qw3h-jr36

Advisories 2

References