CVE-2026-75604
next: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según GHSA, Red Hat.
Descripción
Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| npm::GitHub Security Advisory npm | next | 15.5.24, 16.3.3 |
| chainguard | keep, keep-fips, peerdb-ui y 1 más | 0.54.3-r1 y 2 más |
| echo npm::Echo OSV | next | 15.5.24 |
| minimos | homepage, langfuse-4, peerdb-ui y 1 más | 2.2.0-r0 y 3 más |
| seal npm::Seal Security Database | @seal-security/next, next | 16.0.6-sp999 |
Mostrar las 12 entradas de 5 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| npm::GitHub Security Advisory npm | next | 15.5.24, 16.3.3 |
| chainguard | keep | 0.54.3-r1 |
| chainguard | keep-fips | 0.54.3-r1 |
| chainguard | peerdb-ui | 0.37.5-r1 |
| chainguard | zitadel-4 | 4.17.3-r3 |
| echo npm::Echo OSV | next | 15.5.24 |
| minimos | homepage | 2.2.0-r0 |
| minimos | langfuse-4 | 4.23.0-r0 |
| minimos | peerdb-ui | 0.37.9-r0 |
| minimos | trigger-dev | 4.5.0-r0 |
| seal npm::Seal Security Database | @seal-security/next | 16.0.6-sp999 |
| seal npm::Seal Security Database | next | 16.0.6-sp999 |
Referencias
- https://access.redhat.com/security/cve/CVE-2026-75604
- https://advisory.echohq.com/cve/CVE-2026-75604
- https://github.com/vercel/next.js
- https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b
- https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3
- https://github.com/vercel/next.js/releases/tag/v15.5.24
- https://github.com/vercel/next.js/releases/tag/v16.3.3
- https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36