What is CVE-2026-75604?
CVE-2026-75604 is a path traversal flaw in Next.js that allows an unauthenticated attacker to write files outside the framework’s on-disk cache directory and, from there, reach remote code execution on the host. It is tracked as CWE-22, improper limitation of a pathname to a restricted directory, and is published by Vercel as GHSA-p293-qw3h-jr36.
The vulnerability carries a CVSS v3.1 base score of 9.0 (Critical). Exploitation requires no authentication and no user interaction, and the scope is rated as changed, meaning the impact extends beyond the vulnerable component itself. Attack complexity is rated high, which reflects the specific routing and hosting conditions the target has to meet rather than any difficulty in reaching the endpoint.
The mechanism turns on how Windows treats path separators. Percent-encoded backslash sequences reach the Next.js routing layer without normalization, and on a Windows filesystem the backslash resolves as a directory separator. Directed at a dynamic Pages Router route backed by incremental static regeneration, that lets an attacker steer a filesystem cache write to a location of their choosing. Public proof-of-concept code chains the arbitrary write to a closure-bound Server Action to obtain execution.
The flaw is specific to Windows-hosted deployments. Linux and macOS deployments are not affected, and applications running on Vercel’s managed platform are not affected because that infrastructure runs on Linux. The exposure sits entirely with self-hosted Windows deployments.
What assets are affected by CVE-2026-75604?
The affected range covers Next.js 13.4 up to 15.5.24, and 16.0 up to 16.3.3. Two further conditions have to hold: the application uses the Pages Router or the App Router without Cache Components, and the server runs on a Windows filesystem. An application meeting the version criteria on Linux is outside the scope of this particular flaw.
In practice, an affected asset is an internet-facing, server-rendered web application self-hosted on Windows Server, typically fronted by IIS or a reverse proxy, and typically serving content through incremental static regeneration. These tend to be customer portals, marketing properties, documentation sites, and partner-facing applications rather than core transactional systems, which is part of why they are so often reachable from the public internet.
Framework-level exposures like this one are harder to track than server-level exposures. The Next.js version is a dependency pinned in a build manifest, not a package the platform team patches on a vendor cycle, so it moves only when someone rebuilds and redeploys the application. Windows-hosted Next.js is a minority deployment pattern, usually inherited from an existing .NET and IIS estate, which means it frequently sits outside whatever inventory the organization maintains for its Linux web tier. The framework version is also not consistently advertised in server responses, so the affected subset is difficult to enumerate from the outside without deeper inspection.
What does our data show about exposure patterns?
Exposure in this set is led by Industrials at 16.5% of observed assets, with Information Technology contributing 15.6% and Consumer Discretionary 14.9%.
Industrials and Information Technology lead for the same underlying reason: both tend to operate many small web properties rather than a few large ones. Industrial groups accumulate divisional sites, regional portals, and acquisition-inherited domains, each often built by a different agency or business unit on whatever framework was current at the time. Technology organizations produce documentation sites, developer portals, and product microsites at a similar rate. Next.js is a default choice for exactly that class of property, so it collects wherever web presence is distributed rather than centralized.
The flatness of the distribution is the more useful finding. A framework vulnerability does not respect sector boundaries, because the framework is selected by whoever builds a given site rather than by a central platform function. That makes the risk driver an inventory problem rather than a patching problem. Most organizations can name their internet-facing hosts and domains; far fewer can name the JavaScript framework version running behind each one, or say with confidence which of those hosts are Windows.
Are fixes available?
Yes. Vercel has released fixed versions in both supported lines: Next.js 15.5.24 and 16.3.3. There is no known workaround for affected Windows-hosted applications, and the vendor advisory recommends upgrading immediately rather than attempting to mitigate in place.
The same August 2026 security release also addresses a separate critical heap buffer overflow in AVIF image handling, which originates in the upstream libheif dependency and can be reached through Next.js Image Optimization. The patched releases disable AVIF optimization entirely pending an upstream fix. Teams upgrading for the path traversal flaw will pick up that change at the same time, and should expect AVIF images to be served unoptimized afterwards.
At least one edge provider has shipped a virtual patch signal for this vulnerability at the WAF layer. That is a useful stopgap for deployments that cannot be rebuilt immediately, but it filters requests rather than removing the flaw, and it should not be treated as a substitute for the upgrade. Defenders should verify patch availability and applicability directly with their vendor and against their own build configuration rather than assuming a fix is in place.
Are there any other recommended actions to take?
Until patching is confirmed, defenders should:
- Inventory Windows-hosted Next.js deployments across all internet-facing web properties
- Confirm the Next.js version pinned in each application’s build manifest
- Restrict write access on the cache directory to the application service account
- Monitor the filesystem cache path for writes outside expected route directories
- Block percent-encoded backslash sequences at the reverse proxy or WAF
- Audit externally reachable incremental static regeneration routes on Windows hosts
How can CyCognito help your organization?
CyCognito published an Emerging Threat Advisory for CVE-2026-75604 in the CyCognito platform and is actively researching enhanced detection capabilities for this vulnerability.
To learn how CyCognito can help your organization reduce external exposure and manage emerging threats more effectively, contact us to request a demo.
