CVE-2026-75604

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.

• CWE-22

• https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b
• https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3
• https://github.com/vercel/next.js/releases/tag/v15.5.24
• https://github.com/vercel/next.js/releases/tag/v16.3.3
• https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36

Published

Sep 1, 2026

Last Modified

Sep 4, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75593BuildKit is a toolkit for converting source code to build ar…7.2
• CVE-2026-75594Kirby is an open-source content management system. Prior to …8.2
• CVE-2026-75595Netty is an asynchronous, event-driven network application f…9.1
• CVE-2026-75596Netty is an asynchronous, event-driven network application f…8.7
• CVE-2026-75601Static Web Server (SWS) is a production-ready web server sui…4.3
• CVE-2026-75602OpenList a file list program that supports multiple storage.…6.5
• CVE-2026-7561The Tm – WordPress Redirection plugin for WordPress is vulne…6.1
• CVE-2026-75616An OS command injection vulnerability exists in the web mana…8.5
• CVE-2026-75618Tapo C100/C101 V5 contains a null pointer dereference vulner…6.5
• CVE-2026-75619Tapo C100/C101 V5 contains a heap-based buffer overflow vuln…5.7
• CVE-2026-7562The WP-Redirection plugin for WordPress is vulnerable to Cro…4.3
• CVE-2026-75625Kraken agents fail to verify peer-to-peer downloaded blobs a…9