{"vulnerability": "CVE-2026-75604", "sightings": [{"uuid": "f0805f68-5553-4f75-9222-99daa079c168", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://infosec.exchange/ap/users/116769913619325742/statuses/117178773943525377", "content": "Next.js patched two critical flaws that let an unauthenticated attacker run code on the server.\nApps on Vercel are already fixed. Self-hosted deployments are not.\nUpdate to 15.5.24 or 16.3.3 now. (CVE-2026-75604)\nhttps://suriq.io/blog/nextjs-critical-flaws-self-hosted-rce\n#CVE #CloudSecurity #infosec #cybersecurity", "creation_timestamp": "2026-08-29T16:16:16.344597Z"}, {"uuid": "543eac21-29b2-420b-bf7e-54178d68c73a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "Telegram/Wo1B2qy3supRi9RLVnMbQ41knoxctT-bVTE1SmDL-J33mLU", "content": "", "creation_timestamp": "2026-08-29T23:00:20.812516Z"}, {"uuid": "66ce6669-51a2-4f7b-b1f4-a2cd91e8cd1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "Telegram/Wo1B2qy3supRi9RLVnMbQ41knoxctT-bVTE1SmDL-J33mLU", "content": "", "creation_timestamp": "2026-08-30T00:00:27.726077Z"}, {"uuid": "c8bf4bb2-9a33-4a1e-8a07-ed08fd0a4477", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mu7ukyfmsb2e", "content": "Next.js patched two critical flaws that let an unauthenticated attacker run code on the server.\n\nApps on Vercel are already fixed. Self-hosted deployments are not.\n\nUpdate to 15.5.24 or 16.3.3 now. (CVE-2026-75604)", "creation_timestamp": "2026-08-29T12:23:13.069191Z"}, {"uuid": "9c563650-d14e-4fb3-b9c2-930dc60d3c4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://infosec.exchange/users/obivan/statuses/117166951267868054", "content": "Next.js Windows RCE PoC https://github.com/rafabd1/CVE-2026-75604-poc", "creation_timestamp": "2026-08-27T10:16:34.911295Z"}, {"uuid": "d1509c8d-2807-48e2-aa56-86d74d90aa25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-75604", "type": "seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mu3rucitqc2n", "content": "Thursday's fuck up - It's been a while since I've had fresh meat from Next.js - and here's such a beautiful critical vulnerability RCE - github.com/rafabd1/CVE-... #cve #exploit #poc #redteam #nextjs #cve-2026-75604 #critical #windows #rce", "creation_timestamp": "2026-08-27T11:24:17.291602Z"}, {"uuid": "af535502-8911-428a-aec2-930caac33316", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "Telegram/qhr7w023-vn7u1_ejg3FfnGZ1vCO9Tv-EvHPiDFbLb3J-JQ", "content": "", "creation_timestamp": "2026-08-27T12:00:10.254408Z"}, {"uuid": "632c089f-8149-45d7-a31c-1b470a6832c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "Telegram/mXwJqGjsLNp0LFwWbXU4h3vA714Oj6yIG5AFZePUNxHCgwE", "content": "", "creation_timestamp": "2026-08-27T12:00:07.429107Z"}, {"uuid": "f633fca3-c312-40d0-b837-dcceee889034", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99785", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-75604\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HackSpeak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-26 11:54:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-75604 (Next.js Windows RCE) PoC - unauthenticated RCE via cache path traversal + forged Server Action; for authorized security testing\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-26T14:00:05.641284Z"}, {"uuid": "48692862-1d8f-4069-9e85-083ad6ddf186", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/493", "content": "poc: https://github.com/rafabd1/CVE-2026-75604-poc", "creation_timestamp": "2026-08-28T00:00:11.103217Z"}, {"uuid": "5b5338eb-9b9a-4e77-8d72-eb817efdaee3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://t.me/captainsmok3r_official/492", "content": "two critical Next.js vulnerabilities, including CVE-2026-75604 (CVSS 9.0), enable unauthenticated remote code execution. Patch to 15.5.24 or 16.3.3 now.", "creation_timestamp": "2026-08-28T00:00:11.151921Z"}, {"uuid": "d40f4eaf-3391-4c76-bf6b-630fb14666eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "Telegram/mXwJqGjsLNp0LFwWbXU4h3vA714Oj6yIG5AFZePUNxHCgwE", "content": "", "creation_timestamp": "2026-08-28T00:00:51.186329Z"}, {"uuid": "f16e0e9f-01ba-42f8-a1d7-ab089aedca34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99693", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-75604-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rafabd1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-25 19:35:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-75604 Next.js Windows RCE proof of concept\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-25T22:00:03.476506Z"}, {"uuid": "6a3c044f-de10-4839-8740-850d996463b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "Telegram/qhr7w023-vn7u1_ejg3FfnGZ1vCO9Tv-EvHPiDFbLb3J-JQ", "content": "", "creation_timestamp": "2026-08-28T00:00:52.976185Z"}, {"uuid": "ed85a847-7bea-45ea-895a-8be7442dd899", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3mtz6e6kiuo24", "content": "\ud83d\udea8 CVE-2026-75604 (Critical, CVSS 9.0): pre-auth RCE in Next.js via path traversal in Windows cache. Affects Windows versions before 15.5.24, 16.3.3 and some canary (Pages + App Router without Cache Components).\n\ud83d\udc49 Update now: 15.5.24 / 16.3.3 /  16.4.0-canary.7 \nbuff.ly/LdWZiJF", "creation_timestamp": "2026-08-26T20:29:43.469190Z"}, {"uuid": "a22d795f-0745-4c39-b4c1-0457a9e992a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99693", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-75604-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rafabd1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-25 19:35:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-75604 Next.js Windows RCE proof of concept\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-26T00:00:07.456509Z"}, {"uuid": "efba5206-ca69-4b08-8ce9-77b95719d6d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-75604", "type": "seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mu3b72nco42i", "content": "Critical Next.js & libheif RCE Vulnerabilities: Inside the August 2026 AVIF Zero-Day Exploit\u00a0Chain\n\nCritical Next.js RCE vulnerabilities affect AVIF image optimization and Windows servers. Learn about\u2026\n\nhttps://thecybersecguru.com/news/recommended-url-slug-nextjs-rce-avif-libheif-cve-2026-75604/", "creation_timestamp": "2026-08-27T16:25:54.244190Z"}, {"uuid": "966fd94e-3e51-461c-bc43-81992584b848", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html", "content": "Credit: Hacktron\nVercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which allow unauthenticated remote code execution, one exploitable via specially crafted AVIF image files and the other through a path traversal flaw affecting servers that use a Windows filesystem.\n\nThe Windows path traversal, tracked as CVE-2026-75604&", "creation_timestamp": "2026-08-28T01:00:44.937603Z"}, {"uuid": "65834bdc-621e-4537-8cd6-4442d23a8f11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "Telegram/5OcvQ0Kvc7EZmNnx124YGJsJb961fNxRCYGvYNIkiajBUhEy", "content": "", "creation_timestamp": "2026-08-27T00:00:07.016659Z"}, {"uuid": "e9cd7f90-19fe-4e7d-95e2-8236243c57af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99785", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-75604\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HackSpeak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-26 11:54:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-75604 (Next.js Windows RCE) PoC - unauthenticated RCE via cache path traversal + forged Server Action; for authorized security testing\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-27T00:00:10.331329Z"}, {"uuid": "20e12dd1-72e2-4572-a93f-5fc776271654", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "Telegram/TyxHaxNOYZewY16WupfPzLILXONmDjxPuLwVALABem5R50xg", "content": "", "creation_timestamp": "2026-08-28T15:00:05.299603Z"}, {"uuid": "7d7e12d0-5a01-42e1-bd24-5c97bb4c61e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mtxaajmfdv2q", "content": "Two critical Next.js vulnerabilities, including CVE-2026-75604 (CVSS 9.0), enable unauthenticated remote code execution. Patch to 15.5.24 or 16.3.3 now.\n\n#NextJS #RCE #CyberSecurity #CVE202675604 #WebSecurity", "creation_timestamp": "2026-08-26T01:58:09.366034Z"}, {"uuid": "6b8e81e9-b78c-4810-b3cb-527ae66ca6da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "Telegram/TyxHaxNOYZewY16WupfPzLILXONmDjxPuLwVALABem5R50xg", "content": "", "creation_timestamp": "2026-08-29T00:00:09.637764Z"}, {"uuid": "90bede7d-09b7-4656-8069-5ae1578e4bcb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/securestep9.bsky.social/post/3mu3iwqpz542c", "content": "#NextJS: Two Critical Vulnerabilities in NextJS allow unauthenticated #RCE: one through crafted AVIF images, another via path traversal on Windows (CVE-2026-75604). \nUpgrade your NextJS immediately to v15.5.24 or 16.3.3!:\n\ud83d\udc47", "creation_timestamp": "2026-08-27T18:44:38.004000Z"}, {"uuid": "b2c75c07-4b34-48e4-bd4e-579dda1b0545", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0329", "content": "Vercel heeft twee kwetsbaarheden verholpen in Next.js, een React framework voor het ontwikkelen van (web)applicaties. Een kwaadwillende kan de kwetsbaarheid met kenmerk CVE-2026-75604 misbruiken voor het uitvoeren van willekeurige code op de applicatieserver. De kwetsbaarheid is alleen aanwezig in Next.js-applicaties die op een Windows-omgeving worden gehost en die een Pages- en App-router gebruiken zonder de Cache Component.\n\nNaast deze kwetsbaarheid is er ook een andere kwetsbaarheid verholpen die kwaadwillenden in staat stelt willekeurige code uit te voeren. Hiertoe dient een malafide mediabestand aan een kwetsbare applicatie te worden aangeboden. Deze kwetsbaarheid heeft ten tijde van publicatie nog geen CVE-kenmerk toegekend gekregen.", "creation_timestamp": "2026-08-27T01:00:32.738052Z"}, {"uuid": "8ba80c9d-f2c8-4c5c-ae73-3b93b2c2c79a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html", "content": "Credit: Hacktron\nVercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which allow unauthenticated remote code execution, one exploitable via specially crafted AVIF image files and the other through a path traversal flaw affecting servers that use a Windows filesystem.\n\nThe Windows path traversal, tracked as CVE-2026-75604&", "creation_timestamp": "2026-08-27T19:00:42.064265Z"}, {"uuid": "17432d4d-1331-4785-a47c-48955f5572fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "Telegram/qhr7w023-vn7u1_ejg3FfnGZ1vCO9Tv-EvHPiDFbLb3J-JQ", "content": "", "creation_timestamp": "2026-08-29T00:00:16.348599Z"}, {"uuid": "11c59c19-e37f-428d-9b98-24e5aee94938", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "Telegram/mXwJqGjsLNp0LFwWbXU4h3vA714Oj6yIG5AFZePUNxHCgwE", "content": "", "creation_timestamp": "2026-08-29T00:00:29.027890Z"}, {"uuid": "916bf366-5a92-4acb-89f9-061a2afe4aa3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mu3okvouo527", "content": "\ud83e\udd16 Next.js patches two critical unauth RCE flaws: crafted AVIF image (heap overflow in libheif, CVSS 9.5) and Windows path traversal CVE-2026-75604 (CVSS 9.0). Fixed in 15.5.24 / 16.3.3.\nhttps://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html", "creation_timestamp": "2026-08-27T20:25:08.652362Z"}, {"uuid": "0d5eb292-41be-402f-9ab6-4c4a7614b3e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mu4xp2d6lp2k", "content": "\ud83e\udd16 Next.js: Vercel patches two critical unauthenticated RCEs \u2014 crafted AVIF images and a Windows path traversal (CVE-2026-75604). Upgrade affected versions.\nhttps://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html", "creation_timestamp": "2026-08-28T08:41:10.543898Z"}, {"uuid": "a5672d7a-c897-4f5d-bf75-300aa27aa39e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/493", "content": "poc: https://github.com/rafabd1/CVE-2026-75604-poc", "creation_timestamp": "2026-08-27T22:00:05.890900Z"}, {"uuid": "300383d1-d600-4ed2-9ca3-c082754ea266", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://t.me/captainsmok3r_official/492", "content": "two critical Next.js vulnerabilities, including CVE-2026-75604 (CVSS 9.0), enable unauthenticated remote code execution. Patch to 15.5.24 or 16.3.3 now.", "creation_timestamp": "2026-08-27T22:00:05.937513Z"}, {"uuid": "b06e5731-a1a6-4deb-85dd-b30b68a1a732", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mu52gkyljp2i", "content": "\ud83d\udce2 [VULN] Next.js : deux failles critiques permettent une ex\u00e9cution de code \u00e0 distance sans authentification - CVE-2026-75604\n\nLe 25 ao\u00fbt 2026, Vercel a publi\u00e9 plusieurs nouvelles versions de Next.js : 15.5.24 et 16.3.3. L'objectif ?\n\n#CVE #Cyberveille", "creation_timestamp": "2026-08-28T09:30:07.075701Z"}, {"uuid": "6b233393-779d-49de-9d00-40c4a7bc0aff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0329", "content": "", "creation_timestamp": "2026-08-26T12:15:03.731017Z"}, {"uuid": "98c2e18b-eee0-4860-9220-7792f9ba39b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mu2mkwk4fq42", "content": "Next.js Windows RCE PoC https://github.com/rafabd1/CVE-2026-75604-poc", "creation_timestamp": "2026-08-27T10:16:47.865530Z"}, {"uuid": "002af1a0-790d-424a-b39d-9bb930ddd3d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "Telegram/Wo1B2qy3supRi9RLVnMbQ41knoxctT-bVTE1SmDL-J33mLU", "content": "", "creation_timestamp": "2026-08-31T00:00:40.225506Z"}, {"uuid": "0b1efb63-2b85-4d19-8538-f0be6f0c139b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://www.acn.gov.it/portale/w/next.js-disponibili-poc-per-2-vulnerabilita", "content": "", "creation_timestamp": "2026-08-31T12:45:02.790538Z"}, {"uuid": "b3a83add-323c-4e7e-88c1-609feb40327d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mufpoa26uu2c", "content": "~Checkpoint~\nAttacks hit airports, healthcare and government while actively exploited flaws enable remote code execution.\n-\nIOCs: CVE-2026-82078, CVE-2026-18885, CVE-2026-75604\n-\n#Ransomware #ThreatIntel #Vulnerabilities", "creation_timestamp": "2026-08-31T20:11:31.738877Z"}, {"uuid": "b70ef44f-64a3-4540-b048-74621ec579cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muijoyhfph2z", "content": "\ud83d\udd34 CVE-2026-75604 - Critical (9)\n\nNext.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-75604/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-01T23:02:33.816747Z"}, {"uuid": "f510f956-0408-4614-b9d0-dc5ff528442a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://t.me/HackingTeamGrupoOfficial/48675", "content": "CVE-2026-75604 Next.js Windows RCE \n*\nPoC", "creation_timestamp": "2026-09-02T06:00:05.299042Z"}, {"uuid": "8c02ef6d-da10-4767-9407-34545080c330", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mujwsxkzri2t", "content": "CVE-2026-75604 - next.js\nIf you run a Next.js web app on a Windows server and use certain routing features, an attacker can trick the system into accessing files outside its safe area, exposing secret data and\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#nextjs #vercel #CVE #infosec", "creation_timestamp": "2026-09-02T12:30:04.966565Z"}, {"uuid": "785a0377-1a13-4f8f-a4ad-ecbd60e2096e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://t.me/proxy_bar/3613", "content": "CVE-2026-75604 Next.js Windows RCE \n*\nPoC", "creation_timestamp": "2026-09-02T18:00:05.700898Z"}, {"uuid": "4990a651-edc7-4b7a-a625-193016f371ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/3613", "content": "CVE-2026-75604 Next.js Windows RCE \n*\nPoC", "creation_timestamp": "2026-09-03T00:00:40.377498Z"}, {"uuid": "19b257fa-11a3-4d57-9e00-819a0616c626", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/48675", "content": "CVE-2026-75604 Next.js Windows RCE \n*\nPoC", "creation_timestamp": "2026-09-03T00:00:53.591941Z"}, {"uuid": "be1f004e-3556-4ecf-ac7b-af4f60c414a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://t.me/critical_bug/1824", "content": "\ud83d\udd34 \u041f\u043e\u043b\u043d\u044b\u0439 \u0440\u0430\u0437\u044a\u0451\u0431! \u041e\u0434\u0438\u043d \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u0441\u043b\u0435\u0448 \u2014 \u0438 Next.js-\u0441\u0435\u0440\u0432\u0435\u0440 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u044b: \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f RCE \u043d\u0430 Windows\n\nCVE-2026-75604 | CVSS 9.0 | CWE-22 | \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f\n\n\u0412 Next.js \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0431\u0435\u0437 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 Windows-\u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u043c \u043a\u0435\u0448\u0435 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 \u0438 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 Pages Router \u0438 App Router \u0431\u0435\u0437 Cache Components.\n\n\u041a\u043e\u0440\u043d\u0435\u0432\u0430\u044f \u043f\u0440\u0438\u0447\u0438\u043d\u0430 \u2014 \u0440\u0430\u0437\u043b\u0438\u0447\u0438\u0435 \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0443\u0442\u0435\u0439. Next.js \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b /, # \u0438 ?, \u043d\u043e \u043d\u0435 \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u043b \u043b\u0438\u0442\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u0439 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u0441\u043b\u0435\u0448 \\. \u0414\u043b\u044f Linux \u044d\u0442\u043e \u043e\u0431\u044b\u0447\u043d\u044b\u0439 \u0441\u0438\u043c\u0432\u043e\u043b \u0438\u043c\u0435\u043d\u0438 \u0444\u0430\u0439\u043b\u0430, \u0430 Windows \u0432\u043e\u0441\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0435\u0433\u043e \u043a\u0430\u043a \u0440\u0430\u0437\u0434\u0435\u043b\u0438\u0442\u0435\u043b\u044c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441 ..\\ \u043c\u043e\u0433\u043b\u0438 \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 incremental cache \u0438 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c\u0441\u044f \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c build-\u0444\u0430\u0439\u043b\u0430\u043c.\n\n\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u0442\u0430\u043a:\n\ncache path traversal \u2192 \u0447\u0442\u0435\u043d\u0438\u0435 server-reference-manifest.json \u2192 \u0443\u0442\u0435\u0447\u043a\u0430 AES-\u043a\u043b\u044e\u0447\u0430 Server Actions \u2192 \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u0430 bound arguments \u2192 React Flight gadget \u2192 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 JavaScript \u0432 Node.js \u2192 \u0437\u0430\u043f\u0443\u0441\u043a \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u041e\u0421\n\n\u041e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043e\u043f\u0430\u0441\u043d\u0430 \u0443\u0442\u0435\u0447\u043a\u0430 .next/server/server-reference-manifest.json. \u0412 \u044d\u0442\u043e\u043c \u0444\u0430\u0439\u043b\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f encryptionKey, \u043a\u043e\u0442\u043e\u0440\u044b\u043c Next.js \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u0442 \u0437\u0430\u043c\u043a\u043d\u0443\u0442\u044b\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 Server Actions. \u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u043a\u043b\u044e\u0447 \u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e closure-bound Server Action \u0438\u0437 HTML-\u0444\u043e\u0440\u043c\u044b, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u044b \u0438 \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438\u0445 \u043a\u0430\u043a \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435.\n\n\u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u0439:\n\n- Next.js \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043d\u0430 Windows;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f Pages Router \u0438 App Router;\n- Cache Components \u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0439 \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0439 \u043a\u0435\u0448;\n- \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0439 ISR-\u043c\u0430\u0440\u0448\u0440\u0443\u0442 Pages Router \u0438 \u043a\u0435\u0448\u0438\u0440\u0443\u0435\u043c\u044b\u0439 App Router route;\n- \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u044b\u0439 closure-bound Server Action.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\n- Next.js >= 13.4 \u0438 < 15.5.24;\n- Next.js >= 16.0 \u0438 < 16.3.3.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0432 15.5.24 \u0438 16.3.3. Vercel \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0430\u0434\u0451\u0436\u043d\u043e\u0433\u043e workaround \u043d\u0435\u0442: Windows-\u0440\u0430\u0437\u0432\u0451\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0438 \u0437\u0430\u043d\u043e\u0432\u043e \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435.\n\n\u0414\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0435\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0435 HTTP-\u043f\u0443\u0442\u0438 \u043d\u0430 %5C, ..%5C \u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a /_next/data/, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043a\u043e\u0440\u0440\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0441 \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u043c\u0438 POST-\u0437\u0430\u043f\u0440\u043e\u0441\u0430\u043c\u0438 \u043a Server Actions. \u041d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0445\u043e\u0441\u0442\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u044b \u0434\u043e\u0447\u0435\u0440\u043d\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b cmd.exe \u0438\u043b\u0438 PowerShell, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0435 \u043e\u0442 node.exe, \u0438 \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 Next.js.\n\n\u0420\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u043e\u0435 \u043e\u0431\u044a\u044f\u0441\u043d\u0435\u043d\u0438\u0435: https://eh.su/reports/cve-2026-75604-unauthenticated-rce-v-next-js-cherez-windows-path-traversal-i-server-actions#editor\n\n#NextJS #CVE202675604 #RCE #PathTraversal #ServerActions #React #NodeJS #AppSec #CyberSecurity", "creation_timestamp": "2026-09-03T16:00:05.234877Z"}, {"uuid": "ccc996fc-9e19-4bd1-b147-e47f70280184", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/100974", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-75604\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a FORTBRIDGE-UK\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a HTML\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-03 17:28:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nResearch lab and exploit chain for CVE-2026-75604: path traversal in the Next.js incremental cache, to RCE on Windows.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-03T19:00:05.519469Z"}, {"uuid": "f8152be0-43f8-4dd6-968a-beac33c8d7b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/100974", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-75604\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a FORTBRIDGE-UK\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a HTML\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-03 17:28:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nResearch lab and exploit chain for CVE-2026-75604: path traversal in the Next.js incremental cache, to RCE on Windows.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-04T00:00:39.878355Z"}, {"uuid": "9fc66a32-98d0-4034-8372-c70c4ef7d8be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "https://t.me/critical_bug/1824", "content": "\ud83d\udd34 \u041f\u043e\u043b\u043d\u044b\u0439 \u0440\u0430\u0437\u044a\u0451\u0431! \u041e\u0434\u0438\u043d \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u0441\u043b\u0435\u0448 \u2014 \u0438 Next.js-\u0441\u0435\u0440\u0432\u0435\u0440 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u044b: \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f RCE \u043d\u0430 Windows\n\nCVE-2026-75604 | CVSS 9.0 | CWE-22 | \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f\n\n\u0412 Next.js \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0431\u0435\u0437 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 Windows-\u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u043c \u043a\u0435\u0448\u0435 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 \u0438 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 Pages Router \u0438 App Router \u0431\u0435\u0437 Cache Components.\n\n\u041a\u043e\u0440\u043d\u0435\u0432\u0430\u044f \u043f\u0440\u0438\u0447\u0438\u043d\u0430 \u2014 \u0440\u0430\u0437\u043b\u0438\u0447\u0438\u0435 \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0443\u0442\u0435\u0439. Next.js \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b /, # \u0438 ?, \u043d\u043e \u043d\u0435 \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u043b \u043b\u0438\u0442\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u0439 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u0441\u043b\u0435\u0448 \\. \u0414\u043b\u044f Linux \u044d\u0442\u043e \u043e\u0431\u044b\u0447\u043d\u044b\u0439 \u0441\u0438\u043c\u0432\u043e\u043b \u0438\u043c\u0435\u043d\u0438 \u0444\u0430\u0439\u043b\u0430, \u0430 Windows \u0432\u043e\u0441\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0435\u0433\u043e \u043a\u0430\u043a \u0440\u0430\u0437\u0434\u0435\u043b\u0438\u0442\u0435\u043b\u044c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441 ..\\ \u043c\u043e\u0433\u043b\u0438 \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 incremental cache \u0438 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c\u0441\u044f \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c build-\u0444\u0430\u0439\u043b\u0430\u043c.\n\n\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u0442\u0430\u043a:\n\ncache path traversal \u2192 \u0447\u0442\u0435\u043d\u0438\u0435 server-reference-manifest.json \u2192 \u0443\u0442\u0435\u0447\u043a\u0430 AES-\u043a\u043b\u044e\u0447\u0430 Server Actions \u2192 \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u0430 bound arguments \u2192 React Flight gadget \u2192 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 JavaScript \u0432 Node.js \u2192 \u0437\u0430\u043f\u0443\u0441\u043a \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u041e\u0421\n\n\u041e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043e\u043f\u0430\u0441\u043d\u0430 \u0443\u0442\u0435\u0447\u043a\u0430 .next/server/server-reference-manifest.json. \u0412 \u044d\u0442\u043e\u043c \u0444\u0430\u0439\u043b\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f encryptionKey, \u043a\u043e\u0442\u043e\u0440\u044b\u043c Next.js \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u0442 \u0437\u0430\u043c\u043a\u043d\u0443\u0442\u044b\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 Server Actions. \u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u043a\u043b\u044e\u0447 \u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e closure-bound Server Action \u0438\u0437 HTML-\u0444\u043e\u0440\u043c\u044b, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u044b \u0438 \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438\u0445 \u043a\u0430\u043a \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435.\n\n\u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u0439:\n\n- Next.js \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043d\u0430 Windows;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f Pages Router \u0438 App Router;\n- Cache Components \u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0439 \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0439 \u043a\u0435\u0448;\n- \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0439 ISR-\u043c\u0430\u0440\u0448\u0440\u0443\u0442 Pages Router \u0438 \u043a\u0435\u0448\u0438\u0440\u0443\u0435\u043c\u044b\u0439 App Router route;\n- \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u044b\u0439 closure-bound Server Action.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\n- Next.js >= 13.4 \u0438 < 15.5.24;\n- Next.js >= 16.0 \u0438 < 16.3.3.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0432 15.5.24 \u0438 16.3.3. Vercel \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0430\u0434\u0451\u0436\u043d\u043e\u0433\u043e workaround \u043d\u0435\u0442: Windows-\u0440\u0430\u0437\u0432\u0451\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0438 \u0437\u0430\u043d\u043e\u0432\u043e \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435.\n\n\u0414\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0435\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0435 HTTP-\u043f\u0443\u0442\u0438 \u043d\u0430 %5C, ..%5C \u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a /_next/data/, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043a\u043e\u0440\u0440\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0441 \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u043c\u0438 POST-\u0437\u0430\u043f\u0440\u043e\u0441\u0430\u043c\u0438 \u043a Server Actions. \u041d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0445\u043e\u0441\u0442\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u044b \u0434\u043e\u0447\u0435\u0440\u043d\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b cmd.exe \u0438\u043b\u0438 PowerShell, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0435 \u043e\u0442 node.exe, \u0438 \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 Next.js.\n\n\u0420\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u043e\u0435 \u043e\u0431\u044a\u044f\u0441\u043d\u0435\u043d\u0438\u0435: https://eh.su/reports/cve-2026-75604-unauthenticated-rce-v-next-js-cherez-windows-path-traversal-i-server-actions#editor\n\n#NextJS #CVE202675604 #RCE #PathTraversal #ServerActions #React #NodeJS #AppSec #CyberSecurity", "creation_timestamp": "2026-09-04T00:00:42.549415Z"}, {"uuid": "23b9a1fb-c25b-4953-a285-18006f236b60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "Telegram/tSCLRB07b57aatS-p2DSf41QV3GSxdafymdAv19o1xopakU", "content": "", "creation_timestamp": "2026-09-04T05:00:04.558929Z"}, {"uuid": "4ff401ba-832b-44b3-8015-10a2e34b36af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/newshoundai.bsky.social/post/3mup4dehpbj2b", "content": "The first vulnerability is a Windows path traversal issue identified as CVE-2026-75604 with a CVSS score of 9.0. It affects versions 13.4 through 15.5.23 as well as 16.0 through 16.3.2. This flaw stems from a path traversal weakness that fails to properly restrict file access to a designated", "creation_timestamp": "2026-09-04T13:52:03.292255Z"}, {"uuid": "2a8900c6-7e0b-48aa-96ed-340f21410dd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "published-proof-of-concept", "source": "Telegram/tSCLRB07b57aatS-p2DSf41QV3GSxdafymdAv19o1xopakU", "content": "", "creation_timestamp": "2026-09-05T01:00:38.447352Z"}, {"uuid": "5d067518-4c8a-4013-9345-ab2d0e5bf5b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mv222zokri2z", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers\nCVSS 9 \u00b7 EPSS 1.1%\nhttps://beta.vulnsea.com/cve/CVE-2026-75604\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-08T22:10:53.960919Z"}, {"uuid": "12fd9d24-8144-4e11-9bb1-80dc49e8d240", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/releaseport.com/post/3mvmrpjbrwa2g", "content": "OpenMAIC 1.0.3 patches CVE-2026-75604\nSecurity enhancements mitigate token abuse, XSS, and redirect attacks while improving\nUpgrade carefully.\n\n\u2192 releaseport.com/r/thu-maic-openmaic/v1-0-3", "creation_timestamp": "2026-09-16T09:01:53.071246Z"}, {"uuid": "083ba3e8-2a65-442d-9f7d-c401ba56f099", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75604", "type": "seen", "source": "https://bsky.app/profile/cybersecurity.page/post/3mvry4uyk2j23", "content": "Public exploit code exists for CVE-2026-75604, a Next.js RCE affecting Windows-hosted apps that process untrusted input. Disclosed and exploited in short order, so patching is not optional. Windows Next.js deployments are rarer than you'd think, but they exist.", "creation_timestamp": "2026-09-18T10:42:33.765307Z"}]}