CVE-2026-75604: Remote code execution on Windows-hosted servers

Critical CVSS 9 · Published 2026-09-08 · GHSA-p293-qw3h-jr36 · CVE-2026-75604

Original title: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

What happens

A Pages Router or App Router application (without Cache Components) can be made to run code without authentication when the server uses a Windows filesystem. The weakness is path traversal (CWE-22).

Who is affected

Next.js 13.4.0 or later on a machine with a Windows filesystem, Pages Router or App Router without Cache Components.
Linux and macOS servers are outside the conditions the advisory names.

Affected and fixed versions

Affected	Fixed in
`>= 13.4.0, < 15.5.24`	`15.5.24`
`>= 16.0.0, < 16.3.3`	`16.3.3`

What to do

There is no workaround. The advisory says to upgrade immediately if your server runs on Windows.

Check yourself

Find out whether the machine running next start or server.js is Windows.
Run npm ls next and compare with the table below.

Sources

Rewritten from the original advisory; versions from the GitHub Advisory Database (CC-BY-4.0), updated 2026-10-29. Where they differ, the original advisory wins.