Remote Code Execution Vulnerability in Next.js Framework by Vercel

CVE-2026-75604

What is CVE-2026-75604?

CVE-2026-75604 is a remote code execution vulnerability identified in the Next.js framework, developed by Vercel, which is a popular platform for building full-stack web applications using React. This vulnerability affects versions from 13.4.0 to 15.5.24 and 16.3.3, specifically in configurations that employ either the Pages Router or App Router on Windows-hosted servers without utilizing Cache Components. The core issue arises from inadequate escaping of backslashes in routing segments, which enables attackers to send crafted requests that exploit this oversight. By manipulating the incremental-cache paths, malicious users could potentially access sensitive build data, including encryption keys necessary for server references. The ability to disclose such critical information can lead to remote code execution, seriously compromising the security and integrity of the applications built with this framework.

Potential impact of CVE-2026-75604

1. Unauthorized Access to Sensitive Data: Attackers can exploit this vulnerability to traverse beyond the intended cache root, exposing confidential build data, which may include server credentials and encryption keys crucial for safeguarding application integrity.

2. Remote Code Execution: Successful exploitation allows malicious actors to execute arbitrary code within the affected application environment, potentially leading to full server compromise, application malfunction, or unauthorized control over the system.

3. Impact on Business Continuity: Organizations utilizing Next.js with this vulnerability may face significant operational disruptions due to potential data breaches, system downtime, or loss of customer trust, which could lead to financial losses and reputational damage.

References