CVE-2026-75604

Summary

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

Severity

critical

CVSS

9

EPSS

2.5% (p84)

CWE

CWE-22

Also known as

GHSA-p293-qw3h-jr36

Published

2026-09-08

Updated

2026-09-08

Advisory details

Impact

A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.

Workaround

There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows.

References

• https://github.com/advisories/GHSA-p293-qw3h-jr36
• https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36
• https://nvd.nist.gov/vuln/detail/CVE-2026-75604
• https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b
• https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3
• https://github.com/vercel/next.js/releases/tag/v15.5.24
• https://github.com/vercel/next.js/releases/tag/v16.3.3

Related advisories

• GHSA-2xp9-vwfh-vxw4 — critical · npm/next
• CVE-2026-64649 — high · npm/next
• CVE-2026-64645 — high · npm/next
• CVE-2026-64642 — high · npm/next
• CVE-2026-64641 — high · npm/next
• CVE-2026-64648 — medium · npm/next
• CVE-2026-64647 — medium · npm/next
• CVE-2026-64646 — medium · npm/next

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity