CVE-2026-75604
1 advisory.
npm/next CVE-2026-75604: critical 9
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
Action: Upgrade next to 15.5.24 or later.
npm i next@15.5.24npm i next@16.3.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 13.4.0 | 15.5.24 | - |
| 16.0.0 | 16.3.3 | - |
Fixed versions
| 15.5.24 | 16.3.3 |
Sources
- osv: GHSA-p293-qw3h-jr36
- https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36
- https://nvd.nist.gov/vuln/detail/CVE-2026-75604
- https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b
- https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3
- https://github.com/vercel/next.js
- https://github.com/vercel/next.js/releases/tag/v15.5.24
- https://github.com/vercel/next.js/releases/tag/v16.3.3
CVE-2026-75604 · published · modified · JSON