Skip to content
Threat Feed
Subscribe

Product

Next.js (16.0.0 to 16.3.2)

1 brief RSS
critical advisory

Unauthenticated Remote Command Execution in Next.js on Windows

A critical path traversal vulnerability (CVE-2026-75604) in the Next.js FileSystemCache on Windows allows unauthenticated attackers to steal Server Action encryption keys and execute arbitrary commands.

Next.js +2 web-vulnerability rce path-traversal windows nextjs
1r 2t