CVE-2026-75604 vercel CVE debrief

Who should care

Developers and administrators of Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers; immediate attention required due to critical vulnerability. Affected operators must review compensating controls and verify Next.js application versions. Vulnerability management and security teams should prioritize patching and monitor for suspicious activity.

Technical summary

The Next.js framework is vulnerable to remote code execution due to inconsistent escaping of backslashes in route segments on Windows-hosted servers. A remote request can supply encoded Windows path separators to traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. This issue is fixed in versions 15.5.24 and 16.3.3. The vulnerability impacts applications using Pages Router or App Router without Cache Components. Operators should verify affected deployments, review official advisories, and track exceptions. Defenders should focus on Windows-hosted servers and implement compensating controls.

Defensive priority

Critical vulnerability in Next.js framework; immediate attention required

Recommended defensive actions

• Apply patches or updates to affected Next.js applications
• Review and update affected applications to use Cache Components
• Monitor for suspicious activity and implement compensating controls
• Inventory and verify Next.js application versions
• Implement exception tracking and retest procedures
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

Official CVE Program record and NIST NVD detail page confirm vulnerability in Next.js framework versions 13.4.0 to 15.5.24 and 16.3.3; fix available in versions 15.5.24 and 16.3.3. Evidence limits suggest verifying affected deployments, reviewing official advisories, and tracking exceptions. Defenders should focus on Windows-hosted servers using Pages Router or App Router without Cache Components.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.