CVE-2026-75604 Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
Remote attackers can traverse cache paths on Windows Next.js servers to steal encryption keys and execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-75604?
CVE-2026-75604 is a critical path traversal vulnerability in vercel next.js, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.
Weakness: CWE-22
Which versions are affected by CVE-2026-75604?
4 open source packages ship an affected version, including next.
| Package | Affected | Fixed in |
|---|---|---|
next npm | From 13.4.0 | 15.5.24 |
next npm | From 13.4.0 | 15.5.24 |
next npm | From 16.0.0 | 16.3.3 |
next npm | From 16.0.0 | 16.3.3 |
How do I fix CVE-2026-75604?
Upgrade next to a fixed version for your release line: 15.5.24 or 16.3.3.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-75604 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-75604 exists.
Public exploit code: 1 Metasploit module and 5 proofs of concept on GitHub.
Sources
Also known as CLEANSTART-2026-LG90193, CLEANSTART-2026-TQ64674, CLSA-2026-1791974962, CLSA-2026-1792195714, CLSA-2026-1792195731, CLSA-2026-1792195754 and 50 more.