Packages / next / Security

CriticalVulnerabilityGHSA-p293-qw3h-jr36CVE-2026-75604Published 8 Sep 2026

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

Affected releases · next

  • 16.x16.0.0 – 16.3.2Fixed in 16.3.3
  • 15.x15.0.0 – 15.5.23Fixed in 15.5.24
  • 14.x14.0.0 – 14.2.35No fix on this line yet
  • 13.x13.4.0 – 13.5.11No fix on this line yet

On 16.x, the newest line:

npm install next@16.3.3
16.x

  1. Affected

    16.0.0 – 16.3.2

    36 releases

  2. Fixed

    16.3.3 – 16.4.2

    9 releases, latest

15.x

  1. Affected

    15.0.0 – 15.5.23

    77 releases

  2. Fixed

    15.5.24 – 15.5.28

    5 releases

14.x

  1. Affected

    14.0.0 – 14.2.35

    46 releases

13.x

  1. Not affected

    13.0.0 – 13.3.4

    25 releases

  2. Affected

    13.4.0 – 13.5.11

    31 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Impact

A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.

Workaround

There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows.