CVE-2026-75604

Imagine your website has a “back room” where it stores a secret key. This bug lets someone send carefully crafted requests that trick Next.js into looking in the wrong place on a Windows server, stealing that secret. With the stolen key, the attacker can then run their own code on your server, not just view data.

This matters if you run Next.js on a Windows server and your app uses the Pages or App Router, and you have not enabled Cache Components. The risk exists because the flaw is reachable over the network without requiring a login or user action. It is specifically a Windows-hosted Next.js setup with the stated version range and router/cache conditions.

This should be treated as urgent because it enables unauthenticated remote code execution on Windows-hosted Next.js systems that meet the version and configuration conditions. Even though there’s no clear, dated public incident report in the findings, the impact is severe and the attacker path is network-based without needing credentials.

Confirm exposure

1. Identify the Next.js version currently running in production.
2. Confirm the deployment OS is Windows.
3. Confirm the app is using Pages Router or App Router.
4. Confirm Cache Components are not enabled (the findings call out “without Cache Components” as a precondition).

Patch / upgrade

1. Upgrade Next.js to one of the fixed versions:
   • Upgrade to 15.5.24 or 16.3.3.
2. Redeploy and restart all Next.js instances so the running servers pick up the updated package.
3. Re-check the active version in production after deployment.

If you can’t patch immediately

• Limit exposure by preventing public access to the affected Next.js endpoints (for example, use a WAF/rules or network restrictions) until you complete the upgrade. While this is not a substitute for patching, it reduces the chance that the crafted network requests can reach your app.

What to monitor

• Watch for unusual HTTP request patterns to Next.js/route handling paths from unexpected sources.
• Review application and server logs around deployment time and around any suspicious requests.
• Confirm server integrity after the upgrade (e.g., ensure no unexpected processes or files were created).

KEV / timeline

• This CVE is not listed in CISA KEV in the provided findings.

Severity and verdict: The vulnerability is categorized as critical and assessed as RED in this workflow. Mechanism: On Windows, affected Next.js versions construct incremental-cache file paths using route-derived segments; improper escaping of Windows path delimiters allows encoded path separators to bypass intended path protections, enabling traversal outside the cache root and exposure of private build artifacts, including a server-reference-manifest encryption key. Once that key is disclosed, it can be used to enable remote code execution within the affected application.

Attack prerequisites: No authentication required and no user interaction required. The findings specify Next.js versions 13.4.0 through 15.5.24 and 16.3.3 when using Pages/App Router but without Cache Components, and the target must be running on Windows.

Exploitation status: No KEV listing and no clear dated press claim of real-world exploitation were provided in the findings; no public exploit code is on record. However, because the weakness is an unauthenticated remote code execution path and the impacted condition is fairly specific (Windows + router + version + cache configuration), assume real risk for affected environments.

Fix: The technical backstop indicates the issue is fixed in versions 15.5.24 and 16.3.3. The PATCH finding itself stated no fix/patch information is available, so verify your environment’s upgrade to the fixed versions using your package lockfile and deployment artifacts.

EPSS: A predicted EPSS value was provided (not used as a justification in public blocks because the workflow prioritizes confirmed exploitation signals, and KEV/news do not confirm exploitation here).