Remote arbitrary code execution affecting Next.js
A critical vulnerability affecting Next.js would allow an unauthenticated attacker to remotely execute arbitrary code on Windows servers using certain Next.js configurations.
Description
Technical context and vulnerability details
Next.js is an open source JavaScript framework based on React, used for developing modern web applications with hybrid rendering, both server-side and client-side. This framework is affected by a vulnerability labeled CVE-2026-75604, resulting from improper handling of file paths under Windows. Exploitation of this vulnerability affecting applications simultaneously using the “Pages Router” and “App Router” modules without cache components, would allow an unauthenticated malicious actor to cause a path traversal that could lead to remote arbitrary code execution. It is classified critical, with a severity score of 9.0 according to CVSS v3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Unauthorized access to system files;
- Breach of confidentiality, integrity and availability of data;
Affected systems
Products, components and targeted versions
- Applications using Next.js versions 13.4 to 15.5.23 and 16.0 to 16.3.2, when deployed on a Windows server;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Next.js to version 15.5.24, 15.5 or 16.3.3, depending on the branch used;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.