GitHub Advisoryadvisory · npm

GHSA-p293-qw3h-jr36 Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

CRITICAL Published 2026-09-08 Modified 2026-09-08 Official page ↗
Aliases
CVE-2026-75604
Ecosystem
npm
Packages
next
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2026-09-08

Affected packages

• npm next: >= 13.4.0, < 15.5.24 → fixed in 15.5.24 • npm next: >= 16.0.0, < 16.3.3 → fixed in 16.3.3

Description

Impact A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem. Workaround There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows.

Related

Alias · CVE (1)

  • CVE-2026-75604 Next.js is a React framework for building full-stack web applications. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References