CVE-2026-75604: Next.js Path Traversal Vulnerability

CVE-2026-75604 Overview

CVE-2026-75604 is a path traversal vulnerability [CWE-22] in Next.js, the React framework maintained by Vercel for building full-stack web applications. The flaw affects Next.js versions from 13.4.0 up to (but not including) 15.5.24 and 16.3.3 when deployed on Windows-hosted servers using Pages Router or App Router without Cache Components. Attackers can supply encoded Windows path separators in route segments that traverse outside the intended cache root. Successful exploitation exposes private build artifacts, including the server-reference-manifest encryption key, which can be leveraged for remote code execution against the affected application.

Critical Impact
Remote attackers can traverse the incremental cache directory on Windows deployments, disclose the server-reference-manifest encryption key, and pivot to remote code execution.

Affected Products

Next.js versions 13.4.0 through 15.5.23 (Windows-hosted servers)
Next.js 16.x versions prior to 16.3.3 (Windows-hosted servers)
Applications using Pages Router or App Router without Cache Components

Discovery Timeline

2026-09-01 - CVE-2026-75604 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-75604

Vulnerability Analysis

The vulnerability resides in how Next.js constructs file paths for its incremental cache on Windows. Two files handle route segment escaping and cache path construction: packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts. Neither consistently escapes backslash characters, which Windows treats as a path separator alongside the forward slash.

When a remote request supplies encoded backslashes in a URL segment, Next.js decodes the value and passes it into path.join() as part of the cache key. On Windows, path.join() normalizes backslashes as directory delimiters, allowing the constructed path to escape the intended cache root such as .next/server/pages or .next/server/app.

Once the attacker traverses outside the cache directory, they can read arbitrary files inside the build output. The server-reference-manifest file contains the encryption key used to sign and verify Server Actions payloads. Disclosure of that key enables an attacker to forge trusted Server Action requests, which the framework deserializes and executes, resulting in remote code execution.

Root Cause

The root cause is inconsistent escaping of path delimiters. escape-path-delimiters.ts handled forward slashes but did not treat the backslash as a delimiter. The getFilePath() function in file-system-cache.ts then concatenated the untrusted segment directly onto the cache root without validating that the resolved path remained inside that root.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker sends an HTTP request whose route segment contains URL-encoded backslashes and traversal sequences. The Next.js server, running on Windows, decodes and joins the segment into a cache file path, which resolves outside the intended directory. Attack complexity is high because exploitation depends on Windows path semantics and a vulnerable cache configuration.

The upstream fix restructures getFilePath() to compute a rootDir for each cache kind and then validates that the joined path remains within that root, throwing Invalid file path (error 1468 / 799) when traversal is detected.

typescript

// Patch excerpt: packages/next/src/server/lib/incremental-cache/file-system-cache.ts
-  private getFilePath(pathname: string, kind: IncrementalCacheKind): string {
+  private getFilePath(key: string, kind: IncrementalCacheKind): string {
+    let rootDir: string
     switch (kind) {
       case IncrementalCacheKind.FETCH:
-        return path.join(
-          this.serverDistDir,
-          '..',
-          'cache',
-          'fetch-cache',
-          pathname
-        )
+        rootDir = path.join(this.serverDistDir, '..', 'cache', 'fetch-cache')
+        break
       case IncrementalCacheKind.PAGES:
-        return path.join(this.serverDistDir, 'pages', pathname)
+        rootDir = path.join(this.serverDistDir, 'pages')
+        break
       case IncrementalCacheKind.IMAGE:
       case IncrementalCacheKind.APP_PAGE:
       case IncrementalCacheKind.APP_ROUTE:
-        return path.join(this.serverDistDir, 'app', pathname)
+        rootDir = path.join(this.serverDistDir, 'app')
+        break

Source: Next.js Commit Update

Detection Methods for CVE-2026-75604

Indicators of Compromise

HTTP requests containing URL-encoded backslashes (%5C) or traversal sequences (..%5C, %2e%2e%5c) in route segments targeting Next.js endpoints.
Access log entries showing 200 responses to requests referencing paths outside the application's declared routes.
Unexpected reads of server-reference-manifest.json or other files under .next/server/ on Windows hosts.
Anomalous Server Action invocations following suspicious cache-key requests, potentially signaling forged, signed payloads.

Detection Strategies

Inspect web server and reverse proxy logs for encoded path separators in Next.js request URIs.
Instrument the Next.js process on Windows to alert when the resolved cache path falls outside .next/server/pages, .next/server/app, or .next/cache/fetch-cache.
Monitor for the Next.js runtime error code 1468 (v16) or 799 (v15.5) with message Invalid file path, which the patch emits when traversal is blocked.

Monitoring Recommendations

Enable file integrity monitoring on the .next/ build output directory to flag unexpected read access.
Forward Next.js and IIS/Node process logs into a centralized log platform and alert on the above IOC patterns.
Baseline Server Action traffic and alert on Server Action requests originating from IPs that previously issued encoded-backslash probes.

How to Mitigate CVE-2026-75604

Immediate Actions Required

Upgrade Next.js to 15.5.24 (15.5.x branch) or 16.3.3 (16.x branch) on all Windows-hosted deployments.
Inventory all Next.js applications using Pages Router or App Router without Cache Components and prioritize Windows hosts.
Rotate the server-reference-manifest encryption key by rebuilding and redeploying applications after patching.
Review web access logs for prior exploitation attempts using encoded backslashes.

Patch Information

Vercel released fixed builds in Next.js Release v15.5.24 and Next.js Release v16.3.3. The patch is tracked in GitHub Security Advisory GHSA-p293-qw3h-jr36 and implemented via the 15.5.x commit and 16.3.x commit.

Workarounds

Where immediate patching is not possible, migrate the deployment target from Windows to Linux, which is not affected by the backslash-delimiter behavior.
Enable Cache Components in App Router configurations, which bypasses the vulnerable file-system-cache code path.
Configure the upstream reverse proxy or WAF to reject request paths containing %5C, \, or repeated %2e%2e sequences before they reach the Next.js server.

bash

# Upgrade Next.js on the 15.5.x branch
npm install next@15.5.24

# Upgrade Next.js on the 16.x branch
npm install next@16.3.3

# Verify the installed version
npx next --version