CVE-2026-75604

Next.js, the widely used React web framework published on npm, contains an unauthenticated remote code execution vulnerability classified as CWE-22 (path traversal) and rated critical at CVSS 9.0. The flaw affects applications built with the Pages Router or App Router that do not use Cache Components, and it is triggered only when the server runs on a machine with a Windows filesystem; a remote, unauthenticated attacker can reach it over the network, though exploitability is rated high attack complexity. Successful exploitation yields code execution with high impact to confidentiality, integrity, and availability, and the scope is changed, meaning impact extends beyond the vulnerable component. Only teams self-hosting Next.js on Windows servers are affected; deployments on Linux, macOS, or Vercel's managed infrastructure are not. There is currently no public proof-of-concept, the flaw is not in the CISA KEV catalog, and EPSS assigns a 1.1% probability of exploitation within 30 days, but no workaround exists, so upgrading is the only mitigation.

What to do: If your Next.js server runs on Windows, upgrade immediately to the latest patched release — the advisory does not specify a fixed version, so check the official Next.js security advisory — since there is no known workaround. Deployments hosted on Linux, macOS, or Vercel's managed platform are not affected. Audit your deployments to confirm whether they use the Pages Router or App Router without Cache Components on a Windows filesystem to determine true exposure.