Most recent entries from all

fkie_cve-2026-75604

2026-09-28T23:22:30.485085+00:00

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.

GHSA-p293-qw3h-jr36 — Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

2026-09-28T23:22:30.485203+00:00

Affected: npm: next

## Impact

A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.

## Workaround

There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows.

NCSC-2026-0329 — Kwetsbaarheden verholpen in Next.js

2026-09-28T23:22:30.485269+00:00

NCSC-2026-0329

WID-SEC-W-2026-3027 — Vercel Next.js: Mehrere Schwachstellen ermöglichen Codeausführung

2026-09-28T23:22:30.485306+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um beliebigen Programmcode auszuführen.