CVE-2026-75604, Next.js, Remote Code Execution, Pre-Auth RCE, Path Traversal, Windows Server, Cache Component, App Router, Pages Router, GHSA-p293-qw3h-jr36
Source Material: CVE Record | Next.js August 2026 Advisory | Technology: Next.js Framework, Node.js, Windows Server | Targeted Industries: Opportunistic
Executive Summary
A critical path traversal vulnerability designated as CVE-2026-75604 has been disclosed in the Next.js web framework. The vulnerability allows unauthenticated, remote attackers to achieve arbitrary code execution (RCE) on servers running vulnerable versions of Next.js on Windows environments.
The flaw stems from improper sanitization within the framework’s filesystem cache mechanism when handling requests on Windows operating systems. Exploitation occurs when an application utilizes both the App Router and Pages Router concurrently without Cache Components enabled, allowing remote HTTP requests to write and execute files outside the intended web root.
Vulnerable deployments include Next.js versions 13.4.0 through 15.5.23 and 16.0.0 through 16.3.2 running on Windows systems. Organizations operating self-hosted Windows Node.js infrastructure are at highest risk, Linux hosting environments are not susceptible to this specific path normalization flaw.
Threat Overview and Strategic Impact
CVE-2026-75604 represents a structural vulnerability within modern web infrastructure. Due to its ability to yield unauthenticated command shells on underlying web servers, the flaw is related to caching mechanics and cross-platform path handling.
The root cause lies in how Next.js processes relative file paths on Windows file systems when resolving assets across mixed-router configurations (Pages Router alongside App Router). By crafting requests with encoded backslashes (\) and traversal sequences (..\), an unauthenticated attacker can manipulate the filesystem cache layer to write arbitrary payloads to accessible system paths, subsequently triggering execution via Node.js runtime bindings. Because authentication checks occur higher up in the application logic, the cache mechanism processes these requests prior to session verification, resulting in pre-authentication RCE.
The impact of this vulnerability is significant for enterprise organizations maintaining hybrid cloud or on-premise Windows-based web applications. Successful exploitation gives threat actors an immediate foothold inside the internal perimeter, enabling lateral movement, credential theft, domain enumeration, and persistent access. Additionally, because Next.js applications frequently interface with backend databases, internal APIs, and identity providers, compromised front-end nodes serve as primary launchpads for additional compromise and lateral movement. Organizations utilizing self-hosted Windows, IIS Node reverse proxies, or Windows container pods must treat this threat with immediate urgency due to public availability of functional Proof-of-Concept exploit scripts.
Security Hardening and Recommendations
Organizations operating Next.js web applications should immediately assess their hosting environments and upgrade to fixed releases:
- Upgrade Next.js Dependencies: Immediately update Next.js to version 15.5.24 (for 15.x installations) or 16.3.3 (for 16.x installations) or higher.
- Isolate Windows Deployments: Where immediate patching is delayed, isolate self-hosted Windows web servers behind a Web Application Firewall configured with path traversal rules (..\, ..%5c, %2e%2e%5c).
- Enforce Principle of Least Privilege: Ensure the Node.js process running Next.js operates under a restricted non-admin service account with minimal filesystem write permissions.
Detection Strategy
To identify potential exploitation attempts, security teams should implement a layered detection baseline across web proxies, WAFs, and host endpoints:
- Web Application Firewall & Proxy Telemetry: Inspect incoming HTTP URIs for encoded or raw backslash traversal sequences (%5C..%5C or ..\..\) directed at Next.js application endpoints. Monitor web access logs for unauthorized HTTP GET requests targeting server-reference-manifest.json or path structures under /_next/cache/.
- Endpoint Telemetry (EDR): On Windows endpoints hosting Node.js, monitor for anomalous child process creation where node.exe spawns command shell processes (cmd.exe, powershell.exe, whoami.exe). Monitor for file write anomalies originating from web service accounts into Windows temporary directories (C:\Windows\Temp\).
How Deepwatch Protects Our Customers
Deepwatch Adversary Tactics & Intelligence is analyzing available intelligence for further technical details and exploitation telemetry associated with this activity. Our Guardians are continuously monitoring customer environments for signs of malicious or anomalous activity. Any identified suspicious activity undergoes immediate investigation in accordance with our response procedures.
Relevant Detections
Please visit Guardian Platform to access the relevant detections for this activity.
Technical Artifacts
Please visit Guardian Platform to access the associated technical artifacts.
Threat Object Mapping
Intrusion Set:
- N/A (Due to the general availability of the PoC, it can be leveraged by any actor with initial access)
Attack Pattern (MITRE ATT&CK/MITRE ATLAS):
| Tactic | Technique | Technique ID | Associated Threat Activity |
| Initial Access | Exploit Public-Facing Application | T1190 | WAF Logs, Web Proxy Access Logs |
| Execution | Command and Scripting Interpreter | T1059.001 / .003 | EDR Process Creation Logs |
| Persistence | Server Software Component | T1505 | Host File System Integrity Auditing |
| Credential Access | Exploitation for Credential Access | T1212 | Web Server Access Logs |
| Defense Evasion | Obfuscated Files or Information | T1027 | HTTP Payload Inspection |
Vulnerabilities:
- CVE-2026-75604
Malware/Tool:
- Custom Scripts
Additional Sources
- https://cybersecuritynews.com/next-js-vulnerabilities/
- https://nextjs.org/blog/august-2026-security-release
- https://securityonline.info/nextjs-rce-vulnerability/
Share