Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:vercel:next_js:*:*:*:*:*:*:*:*

1 brief RSS
critical advisory

Unauthenticated Remote Command Execution in Next.js on Windows

A critical path traversal vulnerability (CVE-2026-75604) in the Next.js FileSystemCache on Windows allows unauthenticated attackers to steal Server Action encryption keys and execute arbitrary commands.

Next.js +3 web-vulnerability rce path-traversal windows nextjs
1r 2t 1c updated