EUVD-2026-69702
GHSA-p293-qw3h-jr36
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Windows-hosted Next.js app with server actions
-
DeliveryCraft cache request with encoded backslash traversal
-
ExploitBypass path-delimiter sanitizer on Windows
-
ExecutionRead server-reference-manifest.json encryption key
-
PersistForge server-action payload with leaked key
-
ImpactAchieve remote code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires all of: (1) the Next.js server is Windows-hosted, since the vector depends on the backslash being a native path separator; (2) the app uses Pages Router or App Router WITHOUT Cache Components; (3) an affected version in range 13.4.0-15.5.23 or 16.x below 16.3.3; and (4) the application defines a closure-bound 'use server' action, which is what causes next build to emit the server-reference-manifest.json (with encryptionKey) that the traversal discloses. No authentication or user interaction is needed (PR:N/UI:N), but the Windows-only requirement, the no-Cache-Components requirement, and the need for a server action to exist substantially limit the exploitable population - Linux-hosted deployments and Cache-Components apps are not affected. |
| Impact | The CVSS 3.1 base score is 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H): network-reachable and unauthenticated, but with high attack complexity reflecting the multiple environmental preconditions. Those preconditions are significant and should temper raw-score panic: exploitation requires the server to be Windows-hosted, the app to use Pages Router or App Router WITHOUT Cache Components, and the app to contain a server action so the encryption-key-bearing manifest actually exists on disk. This narrows the realistically exploitable population well below Next.js's overall deployment footprint, since most production Next.js hosting is Linux-based. The S:C/I:H/A:H metrics are driven by the downstream RCE chain rather than the direct primitive - the immediate, confirmed impact is confidentiality (arbitrary private-file read), with code execution being a plausible but multi-step follow-on. No EPSS or KEV data was supplied, so there is no evidence of active exploitation, though the working e2e test constitutes a public proof of concept that lowers the bar for weaponization. Any organization running Next.js on Windows with server actions should treat patching as urgent; Linux-hosted or Cache-Components deployments are not affected and can prioritize accordingly. |
| Exploit ScenarioDerived | An attacker identifies a Windows-hosted Next.js app that uses server actions, then issues a crafted request to the incremental-cache data endpoint (e.g. /_next/data/<buildId>/pages-cache/..%5c..%5cserver-reference-manifest.json) whose encoded backslashes traverse out of the cache root. The server returns server-reference-manifest.json, exposing the encryptionKey, which the attacker then uses to forge or decrypt server-action payloads and achieve remote code execution. A working proof of concept ships as the e2e test in the fix commit, so weaponization is straightforward for a skilled attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Path traversal in Next.js (13.4.0 through 15.5.23 and 16.x before 16.3.3) running on Windows-hosted servers lets a remote unauthenticated attacker escape the incremental-cache root and read private build artifacts, most critically the server-reference-manifest encryption key, which can be leveraged for remote code execution in the application. The flaw stems from route segments not escaping backslashes before cache-path construction, so encoded Windows path separators (e.g. %5c) bypass the sanitizer. Publicly available exploit code exists in the form of the e2e regression test shipped with the fix; no CISA KEV listing or EPSS score was provided.
RemediationAI
Vendor-released patch: upgrade to Next.js 15.5.24 (for 15.x) or 16.3.3 (for 16.x), per GHSA-p293-qw3h-jr36 and the corresponding release tags; the fix (commits 968b9fcb26bdeb8e0a861a9df05361474666d51b and b0f3460a92b955d3ca41fccff9a525a2b910fbf3) both adds backslash handling to the path escaper and enforces a cache-root boundary check. If immediate patching is not possible, the most effective compensating control is to move affected apps off Windows hosting to a Linux/container-based host, which eliminates the backslash-separator vector entirely (trade-off: infrastructure migration effort). Where the app architecture permits, adopting Cache Components also removes the vulnerable code path (trade-off: requires app changes and testing). As a stopgap, place a reverse proxy or WAF rule in front of the app to reject requests whose /_next/data path segments contain encoded backslashes or traversal sequences (%5c, %2e%2e, ..\) targeting the cache endpoints (trade-off: brittle, can be bypassed by alternate encodings and may break legitimate URLs). After patching, rotate the server-reference-manifest encryption key by rebuilding, since a prior disclosure may already have leaked it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Next.js is Vercel's React-based full-stack web framework; the affected component is its file-system incremental cache (packages/next/src/server/lib/incremental-cache/file-system-cache.ts) and the path-delimiter sanitizer (packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts). The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The escape routine matched forward slashes, '#', '?', and their percent-encodings but omitted the backslash - the native path separator on Windows. On Windows hosts, path.join therefore interprets attacker-supplied encoded backslashes as directory separators, allowing '../' style traversal out of the pages/app/fetch-cache root. The private target is server-reference-manifest.json, which Next.js emits (containing an encryptionKey) whenever the app defines a closure-bound 'use server' action; leaking that key undermines the integrity of server-action payloads and opens an RCE path. The CPE cpe:2.3:a:vercel:next.js confirms Vercel as the vendor. The fix adds an explicit rootDir boundary check (filePath.startsWith(rootDir + path.sep)) and adds '\\' to the escape regex.
Know when Next Js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Remote and unauthenticated but AC:H due to Windows-only hosting, no-Cache-Components, and a required server action; direct impact is file disclosure (C:H) with S:C/I:H/A:H reflecting the encryption-key-to-RCE chain.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.
Blast Radius
ecosystem impact- 4 npm packages depend on next (4 direct, 0 indirect)
Ecosystem-wide dependent count for version 13.4.0.
Articles & Coverage 1
Technical POC Analysis
CWE-22, Improper Limitation of a Pathname to a Restricted Directory.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from metasploit
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Next.js applications on Windows servers (versions 13.4.0-15.5.23 and 16.x before 16.3.3) are vulnerable to remote path traversal attacks. Unauthenticated attackers can extract the server-reference-manifest encryption key, enabling remote code execution. Publicly available exploit code exists, creating immediate risk for affected deployments.
Apply vendor patch (upgrade to Next.js 16.3.3 or later). For systems unable to immediately patch: implement WAF rules blocking percent-encoded backslashes (%5c) in HTTP request paths; restrict application server outbound network connectivity to limit RCE propagation; enable comprehensive access logging for .next/cache directory reads to detect exploitation attempts.
Threat Model
3 threats: Information Disclosure, Elevation of Privilege, Tampering
5-step attack chain with trust boundaries and controls
Full threat model - attack chain, trust boundaries, controls per stage and evidence - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
React Server Components in React 19.x contain a critical pre-authentication remote code execution vulnerability (CVE-202
ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to
Pre-authentication denial of service in React Server Components (versions 19.0.0 through 19.2.1) allows unauthenticated
Information disclosure in React Server Components 19.x, distributed as react-server-dom-webpack, react-server-dom-turbop
Server-side request forgery in Vercel Next.js affects self-hosted deployments whose custom middleware calls next()/NextR
Next.js is a React framework that can provide building blocks to create web applications. Rated high severity (CVSS 7.5)
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached
ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace. Rated high severity (CVSS 7.5),
Unsafe deserialization in React Server Components Server Function endpoints allows remote unauthenticated attackers to t
Server-side request forgery in the Next.js Image Optimization endpoint lets a remote, unauthenticated attacker cause the
Next.js versions before 9.3.2 have a directory traversal vulnerability. Rated medium severity (CVSS 4.3), this vulnerabi
Crafted HTTP requests sent to Next.js App Router applications that define at least one Server Action can drive excessive
Exploit-DB