AI analysis
Next.js, the widely used React web framework published on npm, contains an unauthenticated remote code execution vulnerability classified as CWE-22 (path traversal) and rated critical at CVSS 9.0. The flaw affects applications built with the Pages Router or App Router that do not use Cache Components, and it is triggered only when the server runs on a machine with a Windows filesystem; a remote, unauthenticated attacker can reach it over the network, though exploitability is rated high attack complexity. Successful exploitation yields code execution with high impact to confidentiality, integrity, and availability, and the scope is changed, meaning impact extends beyond the vulnerable component. Only teams self-hosting Next.js on Windows servers are affected; deployments on Linux, macOS, or Vercel's managed infrastructure are not. There is currently no public proof-of-concept, the flaw is not in the CISA KEV catalog, and EPSS assigns a 1.1% probability of exploitation within 30 days, but no workaround exists, so upgrading is the only mitigation.
What to do: If your Next.js server runs on Windows, upgrade immediately to the latest patched release — the advisory does not specify a fixed version, so check the official Next.js security advisory — since there is no known workaround. Deployments hosted on Linux, macOS, or Vercel's managed platform are not affected. Audit your deployments to confirm whether they use the Pages Router or App Router without Cache Components on a Windows filesystem to determine true exposure.
Affected
| Vercel Next.js — applications using the Pages Router (without Cache Components) on Windows-hosted servers | — |
| Vercel Next.js — applications using the App Router (without Cache Components) on Windows-hosted servers | — |
Estimated exposure
moderate≈10,000–100,000 Windows-hosted Next.js deployments (estimate) — Next.js is one of the most widely deployed React frameworks (millions of weekly npm downloads and hundreds of thousands of known deployed sites), but the large majority of production deployments run on Linux or Vercel's platform, leaving…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.