Vulnerability Description
Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51
- https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf
- https://github.com/vercel/next.js/releases/tag/v15.5.24
- https://github.com/vercel/next.js/releases/tag/v16.3.3
- https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36
FAQ
What is CVE-2026-75604?
CVE-2026-75604 is a vulnerability with a CVSS score of 9.0 (CRITICAL). Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-h...
How severe is CVE-2026-75604?
CVE-2026-75604 has been rated CRITICAL with a CVSS base score of 9.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-75604?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.