EUVD-2026-69702
GHSA-p293-qw3h-jr36
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Remote and unauthenticated but AC:H due to Windows-only hosting, no-Cache-Components, and a required server action; direct impact is file disclosure (C:H) with S:C/I:H/A:H reflecting the encryption-key-to-RCE chain.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
7Blast Radius
ecosystem impact- 4 npm packages depend on next (4 direct, 0 indirect)
Ecosystem-wide dependent count for version 13.4.0.
DescriptionCVE.org
Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.
Articles & Coverage 1
AnalysisAI
Path traversal in Next.js (13.4.0 through 15.5.23 and 16.x before 16.3.3) running on Windows-hosted servers lets a remote unauthenticated attacker escape the incremental-cache root and read private build artifacts, most critically the server-reference-manifest encryption key, which can be leveraged for remote code execution in the application. The flaw stems from route segments not escaping backslashes before cache-path construction, so encoded Windows path separators (e.g. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of: (1) the Next.js server is Windows-hosted, since the vector depends on the backslash being a native path separator; (2) the app uses Pages Router or App Router WITHOUT Cache Components; (3) an affected version in range 13.4.0-15.5.23 or 16.x below 16.3.3; and (4) the application defines a closure-bound 'use server' action, which is what causes next build to emit the server-reference-manifest.json (with encryptionKey) that the traversal discloses. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H): network-reachable and unauthenticated, but with high attack complexity reflecting the multiple environmental preconditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Next.js 15.5.24 (for 15.x) or 16.3.3 (for 16.x), per GHSA-p293-qw3h-jr36 and the corresponding release tags; the fix (commits 968b9fcb26bdeb8e0a861a9df05361474666d51b and b0f3460a92b955d3ca41fccff9a525a2b910fbf3) both adds backslash handling to the path escaper and enforces a cache-root boundary check. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Next.js deployments on Windows infrastructure and determine current versions; prioritize 16.x instances for patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
React Server Components in React 19.x contain a critical pre-authentication remote code execution vulnerability (CVE-202
ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to
Next.js is a React framework that can provide building blocks to create web applications. Rated high severity (CVSS 7.5)
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached
ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace. Rated high severity (CVSS 7.5),
Next.js versions before 9.3.2 have a directory traversal vulnerability. Rated medium severity (CVSS 4.3), this vulnerabi
Next.js is a React framework for building full-stack web applications. Rated high severity (CVSS 7.5), this vulnerabilit
Next.js is a React Framework for the Web. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no
Next.js is a React framework for building full-stack web applications. Rated high severity (CVSS 7.5), this vulnerabilit
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authenticat
Next.js is a React framework that can provide building blocks to create web applications. Rated high severity (CVSS 7.5)
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authenticat
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today