Product

Next.js (15.5 < 15.5.24, 16.3 < 16.3.3)

1 brief RSS

Unauthenticated Remote Command Execution in Next.js on Windows

A critical path traversal vulnerability (CVE-2026-75604) in the Next.js FileSystemCache on Windows allows unauthenticated attackers to steal Server Action encryption keys and execute arbitrary commands.

Next.js +3 web-vulnerability rce path-traversal windows nextjs

1r 2t updated 2h ago