Loading vulnerability…
CVE-2026-75604 is a critical unauthenticated remote-code-execution vulnerability in Next.js caused by a path-traversal condition. It affects Next.js applications hosted on Windows that simultaneously use the Pages Router and App Router while Cache Components are not enabled. Exploitation can enable traversal behavior that is leveraged to execute arbitrary code in the application-server context. Linux and macOS deployments are not affected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This is a standalone Python 3 proof-of-concept exploit, not a module from a recognized exploit framework. Its primary entry point, `poc.py`, targets CVE-2026-75604 in vulnerable Windows Next.js deployments. It validates an HTTP(S) target, obtains a Pages Router build ID, and uses Windows backslash-encoded traversal sequences (`..%5C`) through both App Router and Pages Router cache routes to retrieve the Next.js server-reference manifest. The manifest provides the Server Action encryption material/metadata needed to construct a malicious encrypted Server Action request. The PoC then invokes a compatible closure-bound Server Action to execute the configurable command and waits on an attacker callback listener for confirmation. It includes explicit vulnerable/not-vulnerable/inconclusive error handling, TLS-verification disablement, target and callback timeouts, and automated HTML form-field discovery when possible. The repository also contains an optional local reproduction target under `target/`. It is a small mixed-router Next.js application pinned to Next.js 16.2.11: `target/pages/pages-cache/[...rest].js` creates a dynamic ISR Pages route, `target/app/app-cache/[...rest]/page.js` creates a revalidated App Router route, and `target/app/page.js` defines the closure-bound Server Action used by the PoC. `target/package.json` builds and launches the demonstration server on port 4330. Python dependencies are limited to `requests` and `cryptography`, the latter supporting AES-GCM handling of Server Action data. No fixed third-party C2, public target IP address, registry persistence, or destructive behavior is present; target and callback addresses are supplied at runtime.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical, unauthenticated path-traversal vulnerability in Next.js that can lead to remote code execution on servers using a Windows filesystem.
An unauthenticated remote-code-execution vulnerability in Next.js that enables an attacker to identify a vulnerable build, leak an encryption key, enumerate and invoke Server Actions, and execute a payload remotely.
Critical unauthenticated remote-code-execution vulnerability in Windows-hosted Next.js applications that use both the Pages Router and App Router without Cache Components. Linux and macOS are not affected.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.