CVE-2026-75604criticalCode execution2026-09-08
CVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.
What it is
A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.
There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows.
How to check
- Affected: next (npm) >= 13.4.0, < 15.5.24.
- Affected: next (npm) >= 16.0.0, < 16.3.3.
- Compare your installed version with the range above (command below).
How to fix
- Upgrade next to 15.5.24 or later.
- Upgrade next to 16.3.3 or later.
npm ls nextSources
More advisories for this tool
- criticalCVE-2025-29927: Next.js middleware authorization bypass
- highSecrets leaked via NEXT_PUBLIC_ (or VITE_) environment variables
- highCVE-2026-44578: Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades
- highCVE-2026-44574: Next.js has a Middleware / Proxy bypass through dynamic route parameter injection