External risk intelligence

Next.js Route Segment Backslash Escaping Vulnerability Exposes Build Data and Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-75604

Next.js is a framework commonly used to build web applications that are deployed as internet-facing services. While the specific vulnerability requires a Windows-hosted server, the framework itself is designed for public-facing web traffic, making it common for applications built with it to be reachable from the internet.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in the Next.js framework, a tool used for building web applications. The issue could allow an attacker to access sensitive build data, potentially leading to unauthorized code execution on affected servers. The primary concern is confirming if your Next.js applications on Windows servers are exposed to this risk.

Input flaws allow data exposure.
Key compromise enables code execution.
Verify relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted remote request to a Next.js application hosted on a Windows server, provided it's not using cache components. The application's failure to properly escape backslashes in route segments allows the request to traverse beyond the intended cache directory. This can expose sensitive build data, including an encryption key, which if disclosed, could lead to remote code execution on the affected server.

Accessible via network requests.
Exploits unescaped path delimiters.
Leads to build data exposure and RCE.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to access sensitive build data, including an encryption key for server references. When supported by the advisory, this could be achieved by sending specially crafted requests that manipulate path delimiters in route segments on Windows-hosted servers, potentially leading to unauthorized disclosure of information and remote code execution.

Server build data and encryption keys.
Encoded path separators in route segments.
Information disclosure and RCE.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world action likely falls to the platform or application teams responsible for Next.js deployments, particularly those on Windows servers. The initial focus should be on locating all instances of the affected Next.js versions, confirming their exposure and criticality, identifying the specific owner for each instance, and then collaboratively planning remediation based on risk and business impact.

Platform/App teams own the issue.
Verify affected Next.js instances and exposure.
Plan coordinated remediation with owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Next.js and why does it matter here?

Next.js is a popular React-based framework used by developers to create full-stack web applications. It simplifies tasks like routing and page rendering for modern websites. This vulnerability matters because it affects how the framework manages internal file paths when running on specific operating systems, potentially compromising the integrity of the data the application serves.

How does CVE-2026-75604 cause a security weakness?

This issue is a Path Traversal vulnerability, classified as CWE-22. It happens when the software fails to properly sanitize input containing backslashes in route segments. Because the application does not escape these characters correctly, a request can trick the system into looking for files outside of the designated cache directory, leading to the unauthorized disclosure of sensitive server configuration data.

What triggers this Next.js vulnerability?

An attacker triggers this by sending a crafted network request containing encoded Windows path separators to an affected application. The bug specifically requires the application to be running on a Windows-hosted server. Importantly, applications that use Cache Components or are hosted on non-Windows environments, such as Linux, are not susceptible to this specific path traversal flaw.

Is my application at risk according to Halo Surface Signal?

Halo Surface Signal notes that because Next.js is frequently used for internet-facing web applications, the framework is often exposed to public traffic. If your application is built with an affected version and runs on a Windows server reachable from the internet, it is considered to have a higher potential for impact compared to services that remain internal or are hosted on other platforms.

How do I secure my environment against this CVE?

The primary step is to update your Next.js application to version 15.5.24 or 16.3.3, which contain the necessary fixes for path delimiter handling. Coordinate with your platform or development teams to audit all running instances, confirm if they are hosted on Windows, and prioritize updating those that are exposed to network traffic to prevent potential build data disclosure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.