---
title: "CVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers"
url: https://erroneo.us/security/cve/CVE-2026-75604/
description: "CVE-2026-75604 (next (npm)): Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-09-01
date_modified: 2026-09-30
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-75604"
kev: false
cvss: 9
epss: 0.02105
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 2.1% , percentile 82: FIRST’s model estimates a 2.1% chance of exploitation activity in the next 30 days, higher than 82% of all scored CVEs (elevated). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes next (npm) >= 13.4.0, < 15.5.24, fixed in 15.5.24 ; next (npm) >= 16.0.0, < 16.3.3, fixed in 16.3.3 . Check your lockfile, including transitive dependencies.
- Editorial verdict: Patch this week. Next.js: Windows, AVIF and next/og RCEs (Aug-Sep 2026) — Self-hosted Next.js apps still below 15.5.24 or 16.3.3 should upgrade now, ideally straight to the October releases; Windows hosts and apps optimizing untrusted AVIF images are the urgent cases.

## What it is

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.

## Affected packages

- npm `next` >= 13.4.0, < 15.5.24 → fixed: 15.5.24
- npm `next` >= 16.0.0, < 16.3.3 → fixed: 16.3.3

## Affected products (CVE record)

- vercel next.js: >= 13.4.0, < 15.5.24, >= 16.0.0, < 16.3.3

## Severity

- GitHub_M CVSS 3.1: 9 `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.0 `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 2.10% probability of exploitation activity in the next 30 days; percentile 82.

## Sources

- [GitHub Advisory GHSA-p293-qw3h-jr36](https://github.com/advisories/GHSA-p293-qw3h-jr36)
- [CVE.org record CVE-2026-75604](https://www.cve.org/CVERecord?id=CVE-2026-75604)
- [NVD entry CVE-2026-75604](https://nvd.nist.gov/vuln/detail/CVE-2026-75604)
- [github.com](https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36)
- [github.com](https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b)
- [github.com](https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3)
- [github.com](https://github.com/vercel/next.js/releases/tag/v15.5.24)
- [github.com](https://github.com/vercel/next.js/releases/tag/v16.3.3)

---
Source page: https://erroneo.us/security/cve/CVE-2026-75604/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt