CVE-2026-75604
CriticalCVSS 9.0Summary
Next.js, a React framework for full-stack applications, versions 13.4.0 through 15.5.24 and 16.3.3, on Windows-hosted servers does not properly escape backslashes in route segments when constructing cache paths, allowing a remote attacker to traverse outside the cache root and expose private data, including the server-reference-manifest encryption key. Disclosure of this key can enable remote code execution. Fixed in versions 15.5.24 and 16.3.3.
Risk Assessment
An attacker can access sensitive application data, including encryption keys, potentially leading to full application compromise and remote code execution.
Recommendation
Upgrade Next.js to version 15.5.24 or 16.3.3 (or later) depending on your branch to prevent exploitation.
Other vulnerabilities in Next.js
See all- CVE-2017-16877High
Next.js before 2.4.1 has a directory traversal vulnerability in the /_next and /static request namespace, allowing attackers to obtain sensitive information.
- CVE-2026-44578High
Next.js versions from 13.4.13 to before 15.5.16 and 16.2.5 are vulnerable to server-side request forgery (SSRF) via crafted WebSocket upgrade requests. An attacker can force the server to proxy requests to arbitrary internal or external destinations, potentially exposing internal services or cloud metadata endpoints.
- CVE-2026-64649Medium
In Next.js, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (SSRF). In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization.
- CVE-2026-64648Medium
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. This issue has been fixed in versions 15.5.21 and 16.2.11.
- CVE-2026-64647Medium
In Next.js versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. This leads to leakage of confidential POST response data to unauthorized requests. The issue only occurs with request bodies using a charset other than UTF-8.
- CVE-2026-64646Medium
In Next.js versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Action uses the Edge runtime.
- CVE-2026-64645Medium
Next.js versions 12.0.0-15.5.20 and 16.0.0-16.2.10 have a vulnerability in rewrites()/redirects() rules with external hostnames from requests. Attackers can point requests to arbitrary hosts, causing SSRF (rewrite) or Open Redirect (redirect).
- CVE-2026-64644Medium
In Next.js versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints. Only config.images.remotePatterns is affected.
- CVE-2026-64643Medium
In Next.js versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, applications using App Router and Server Actions can disclose Server Action IDs to unauthenticated users via publicly served client artifacts. This disclosure is typically a recon primitive but increases risk when combined with other weaknesses.
- CVE-2026-64642High
Next.js versions 16.0.0-16.2.10 have a vulnerability in applications using App Router with Turbopack and a single entry in config.i18n.locales. Crafted requests can bypass middleware/proxy-based authentication.
Original NVD description (English source)
Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.