CVE-2026-75604

Name of the Vulnerable Software and Affected Versions Next.js versions 13.4.0 through 15.5.23 Next.js versions 16.0.0 through 16.3.2

Description Two unauthenticated remote code execution issues affect Next.js. The first issue occurs on Windows-hosted servers using Pages Router or App Router without Cache Components. The application fails to consistently escape backslashes in route segments before constructing incremental-cache paths within packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts. A remote attacker can use encoded Windows path separators to perform a path traversal, allowing them to access private build data such as the server-reference-manifest encryption key. Obtaining this key enables the attacker to execute arbitrary code on the server.

The second issue is located in the image-optimization path. When processing attacker-controlled AVIF images using the sharp library and the underlying libheif library, a memory-safety failure can occur, potentially leading to remote code execution without authentication or user interaction.

Recommendations Upgrade to version 15.5.24 or 16.3.3. As a temporary mitigation for the Windows-hosted issue, enable Cache Components or avoid the simultaneous use of Pages Router and App Router on Windows hosts. Restrict the processing of AVIF images through the image-optimization path until the update is applied.