CVE-2026-75604

Описание

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.

A flaw was found in Next.js. When running on Windows systems, the application fails to properly sanitize backslashes in request paths before building file cache locations. An unauthenticated remote attacker can exploit this directory traversal weakness by submitting crafted requests to access sensitive build files and encryption keys, which can lead to arbitrary code execution.