Developers running certain Next.js applications on Windows are being urged to update after a critical vulnerability was found that could allow attackers to execute code remotely without logging in first.
The flaw, tracked as CVE-2026-75604, affects applications using the Pages Router or App Router without Cache Components when hosted on a Windows filesystem. Vercel has rated the vulnerability Critical, with a CVSS score of 9.0 out of 10.
Remote code execution is among the more serious types of software vulnerability because a successful attack can go beyond disrupting a website or exposing limited information. It can allow code to be run on the affected server.
Windows hosting is the important distinction
The vulnerability does not affect every website or application built with Next.js. The advisory specifically points to affected configurations running on machines that use a Windows filesystem.
Affected releases include Next.js versions from 13.4 up to, but not including, 15.5.24, along with versions from 16.0 up to, but not including, 16.3.3.
The fixed releases are 15.5.24 and 16.3.3.
For administrators running a vulnerable Next.js deployment on Windows, updating is the only recommended fix currently available.
Vercel says there is no known workaround for affected Windows-hosted applications and advises users to upgrade immediately.
That makes checking the version of any Windows-based Next.js deployment particularly important, even though applications hosted under other conditions are outside the scope described in the advisory.
Leave a Reply