CVE-2026-75604

Name of the Vulnerable Software and Affected Versions Next.js versions 13.4.0 through 15.5.23 Next.js versions 16.0.0 through 16.3.2

Description Two unauthenticated remote code execution issues affect Next.js. The first issue is a path traversal in the filesystem cache specifically affecting servers hosted on Windows using the Pages Router or the App Router without Cache Components. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, the software does not consistently escape backslashes in route segments. A remote request can supply encoded Windows path separators to traverse outside the intended cache root and expose private build data, such as the server-reference-manifest encryption key, which can then be used to execute arbitrary code on the server.

The second issue exists in the image-optimization path. When processing attacker-controlled AVIF images via the sharp library and the underlying libheif library, a memory-safety failure can occur, allowing for remote code execution without authentication or user interaction.

Recommendations Update Next.js to version 15.5.24. Update Next.js to version 16.3.3. As a temporary workaround for the Windows-hosted issue, transition to using Cache Components or avoid the simultaneous use of Pages Router and App Router on Windows hosts. As a temporary mitigation for the Windows-hosted issue, run the application behind a reverse proxy with strict path normalization rules. Disable image optimization endpoints if they are not required to minimize the risk of the AVIF-related issue.