EUVD-2026-69702Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Remote and unauthenticated but AC:H due to Windows-only hosting, no-Cache-Components, and a required server action; direct impact is file disclosure (C:H) with S:C/I:H/A:H reflecting the encryption-key-to-RCE chain.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.
AnalysisAI
Path traversal in Next.js (13.4.0 through 15.5.23 and 16.x before 16.3.3) running on Windows-hosted servers lets a remote unauthenticated attacker escape the incremental-cache root and read private build artifacts, most critically the server-reference-manifest encryption key, which can be leveraged for remote code execution in the application. The flaw stems from route segments not escaping backslashes before cache-path construction, so encoded Windows path separators (e.g. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of: (1) the Next.js server is Windows-hosted, since the vector depends on the backslash being a native path separator; (2) the app uses Pages Router or App Router WITHOUT Cache Components; (3) an affected version in range 13.4.0-15.5.23 or 16.x below 16.3.3; and (4) the application defines a closure-bound 'use server' action, which is what causes next build to emit the server-reference-manifest.json (with encryptionKey) that the traversal discloses. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H): network-reachable and unauthenticated, but with high attack complexity reflecting the multiple environmental preconditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Next.js 15.5.24 (for 15.x) or 16.3.3 (for 16.x), per GHSA-p293-qw3h-jr36 and the corresponding release tags; the fix (commits 968b9fcb26bdeb8e0a861a9df05361474666d51b and b0f3460a92b955d3ca41fccff9a525a2b910fbf3) both adds backslash handling to the path escaper and enforces a cache-root boundary check. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Next.js deployments on Windows infrastructure and determine current versions; prioritize 16.x instances for patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
React Server Components in React 19.x contain a critical pre-authentication remote code execution vulnerability (CVE-202
Next.js is a React framework that can provide building blocks to create web applications. Rated high severity (CVSS 7.5)
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached
ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace. Rated high severity (CVSS 7.5),
Next.js versions before 9.3.2 have a directory traversal vulnerability. Rated medium severity (CVSS 4.3), this vulnerabi
Next.js is a React framework for building full-stack web applications. Rated high severity (CVSS 7.5), this vulnerabilit
Next.js is a React Framework for the Web. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no
Next.js is a React framework for building full-stack web applications. Rated high severity (CVSS 7.5), this vulnerabilit
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authenticat
Next.js is a React framework that can provide building blocks to create web applications. Rated high severity (CVSS 7.5)
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authenticat
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authenticat
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today