Loading vulnerability…
CVE-2026-75604 is a Windows-specific path traversal vulnerability in Next.js incremental-cache handling. Affected Next.js releases do not consistently escape backslashes in request route segments before constructing filesystem cache paths. An unauthenticated remote attacker can supply encoded Windows path separators to escape the intended cache root, allowing disclosure of private application build data and potentially controlled writes of cache-rendered content. Disclosed build data can include the encryption key used to protect Next.js Server Action bound arguments. In susceptible application and version configurations, recovery of that key can be chained with forged Server Action arguments to achieve remote code execution. The issue affects Windows-hosted applications using the Pages Router or the App Router without Cache Components, in versions 13.4.0 through 15.5.23 and 16.0.0 through 16.3.2.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This 26-file JavaScript/PowerShell research lab targets CVE-2026-75604 in Next.js incremental-cache path handling on Windows. The primary exploit, exploit.mjs, derives a public build ID, sends an App Router cache-warming request containing `..%5C`, and reads the same traversed cache key through a Pages Router `/_next/data/` endpoint. It explicitly documents that the disclosure is destructive: cache persistence subsequently overwrites the accessed target with route-generated content. `flight-forge.mjs` and `forge-cli.mjs` implement offline AES-GCM decryption/encryption of Server Action bound arguments using a stolen manifest key. `send-action.mjs` and rce-chain.mjs assemble a forged React Flight `constructor:constructor` gadget and a multipart Server Action request carrying Node/Windows command-execution JavaScript. The repository also includes a deliberately vulnerable minimal Next.js application, a Windows build/start script, reproduction instructions, evidence, and version research. Importantly, the included 16.3.2 app dependency remains traversal-vulnerable but is documented as not RCE-capable through this gadget; the RCE workflow requires setup with 16.2.x or the specified 15.x range plus the intentionally unsafe higher-order Server Action in app/app/page.js.
This is a small standalone Python repository containing one executable exploit tool, NextRCE.py, plus a README, MIT license, and a standard Python .gitignore. It is not a Metasploit, Nuclei, or other recognized exploit-framework module. The script accepts a target URL, callback IP/port, cache type, payload type, optional HTTP(S) proxy, and a check-only flag. It first offers lightweight Next.js fingerprinting by requesting the target root page and the public /_next/static/chunks/main.js asset, checking for X-Powered-By: Next.js and __next markers. Its active path constructs POST requests to /pages-cache/seed or /app-cache/seed with several Windows backslash and percent-encoded dot-segment traversal patterns. It attempts to deliver JavaScript intended either to create a Node.js cmd.exe reverse shell or a command-executing Next.js API webshell; custom payload content and destination paths are also supported. The README describes the claimed target as CVE-2026-75604 affecting certain Windows-hosted Next.js cache configurations, and identifies 15.5.24 and 16.3.3 as fixed releases. The check-only feature is detection/fingerprinting functionality, but the repository also contains active payload-delivery and command-execution logic, so it is not solely a detection script. Functional exploitability cannot be established from the fingerprinting checks alone and depends on the claimed vulnerable cache implementation and deployment configuration.
This is a standalone Python 3 proof-of-concept exploit for CVE-2026-75604 / GHSA-p293-qw3h-jr36, rather than a Metasploit, Nuclei, or other framework module. The primary entry point, poc.py (about 15 KB), validates a target origin, discovers a Pages Router build ID, constructs encoded `..%5C` cache traversal requests, and retrieves the Next.js Server Action reference manifest. The intended Windows-specific flaw is improper handling of encoded backslash path delimiters by Next.js FileSystemCache. The manifest leak exposes the Server Action encryption key and action data needed to create a forged encrypted closure-bound Server Action invocation, resulting in arbitrary command execution. The PoC accepts a customizable command (default `whoami`) and runs an HTTP callback listener for execution output/confirmation. It includes error handling that distinguishes not-vulnerable and inconclusive cases, HTML form parsing to identify the compatible Server Action field, TLS-verification disabling via --insecure, and configurable timeouts/callback settings. The repository also includes a deliberately vulnerable local Next.js 16.2.11 target under target/: an App Router cached route, a Pages Router ISR route, and a root Server Action whose closure pattern satisfies the exploit precondition. requirements.txt identifies cryptography and requests dependencies; package.json/package-lock.json pin the demonstration application's Next.js and React dependencies.
This is a standalone Python 3 proof-of-concept exploit, not a module from a recognized exploit framework. Its primary entry point, `poc.py`, targets CVE-2026-75604 in vulnerable Windows Next.js deployments. It validates an HTTP(S) target, obtains a Pages Router build ID, and uses Windows backslash-encoded traversal sequences (`..%5C`) through both App Router and Pages Router cache routes to retrieve the Next.js server-reference manifest. The manifest provides the Server Action encryption material/metadata needed to construct a malicious encrypted Server Action request. The PoC then invokes a compatible closure-bound Server Action to execute the configurable command and waits on an attacker callback listener for confirmation. It includes explicit vulnerable/not-vulnerable/inconclusive error handling, TLS-verification disablement, target and callback timeouts, and automated HTML form-field discovery when possible. The repository also contains an optional local reproduction target under `target/`. It is a small mixed-router Next.js application pinned to Next.js 16.2.11: `target/pages/pages-cache/[...rest].js` creates a dynamic ISR Pages route, `target/app/app-cache/[...rest]/page.js` creates a revalidated App Router route, and `target/app/page.js` defines the closure-bound Server Action used by the PoC. `target/package.json` builds and launches the demonstration server on port 4330. Python dependencies are limited to `requests` and `cryptography`, the latter supporting AES-GCM handling of Server Action data. No fixed third-party C2, public target IP address, registry persistence, or destructive behavior is present; target and callback addresses are supplied at runtime.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
48 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unauthenticated remote code execution vulnerability in Next.js applications using the Pages Router or App Router without Cache Components when hosted on servers using a Windows filesystem.
A Windows-specific Next.js incremental-cache path traversal caused by failure to escape backslash characters in cached route paths. Percent-encoded backslashes can escape the cache root, enabling unauthenticated arbitrary file reads and writes accessible to the server process. Reading the Server Action encryption key can enable forged Server Action arguments, authorization bypass, and, in susceptible versions with a dangerous higher-order Server Action pattern, remote code execution.
A high-impact network-reachable vulnerability in Vercel Next.js that requires high attack complexity but no privileges or user interaction. Successful exploitation can affect confidentiality, integrity, and availability at high impact, including across a security scope boundary.
A high-impact path traversal vulnerability (CWE-22) in Next.js incremental-cache path construction on Windows-hosted servers. Encoded Windows path separators can escape the intended cache root and disclose private build data, including a server-reference-manifest encryption key; disclosure of that key can enable remote code execution in the affected application.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.