Skip to content
Threat Feed
Subscribe

Product

Next.js (13.4 to 15.5.23)

1 brief RSS
critical advisory

Unauthenticated Remote Command Execution in Next.js on Windows

A critical path traversal vulnerability (CVE-2026-75604) in the Next.js FileSystemCache on Windows allows unauthenticated attackers to steal Server Action encryption keys and execute arbitrary commands.

Next.js +2 web-vulnerability rce path-traversal windows nextjs
1r 2t