CVE-2026-75604: 
Chainguard vulnerability analysis and mitigation

CVE-2026-75604 is a path traversal vulnerability in Next.js (React framework by Vercel) that enables unauthenticated remote code execution on Windows-hosted servers. Affecting versions 13.4.0 through 15.5.23 and 16.0.0 through 16.3.2, the flaw allows remote attackers to traverse outside the incremental cache root directory and expose private build data — including the server-reference-manifest AES encryption key — which can then be leveraged to achieve RCE. The vulnerability was disclosed on August 25, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 9.0 (Critical) (GitHub Advisory, Feedly).

The root cause (CWE-22: Path Traversal) lies in two source files: packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts. The escapePathDelimiters function's regex did not include the backslash character (\), meaning URL-encoded Windows path separators (%5C) in dynamic route segments were not escaped before being used to construct incremental cache file paths. On Windows, path.join() resolves these backslashes as directory separators, allowing an attacker to traverse outside the intended cache root (e.g., .next/server/pages or .next/server/app) and read arbitrary files such as server-reference-manifest.json. The fix adds \\ to the escape regex and introduces a boundary check in getFilePath() that throws an error if the resolved path escapes the root directory (GitHub Commit 15.5.x, GitHub Commit 16.3.x). Exploitation requires the application to use Pages Router or App Router without Cache Components, and the server must be hosted on a Windows filesystem (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to read the server-reference-manifest.json file, which contains the AES encryption key used to protect Server Action bound arguments. With this key, an attacker can forge encrypted Server Action payloads that inject arbitrary JavaScript — specifically process.mainModule.require('child_process').exec() — achieving full remote code execution as the Next.js application process on the Windows server. This results in complete confidentiality, integrity, and availability compromise of the affected application, and can serve as an initial foothold for lateral movement, privilege escalation, or data exfiltration within the hosting environment (GitHub Advisory, Feedly).

Multiple fully functional public proof-of-concept exploits exist, including standalone Python scripts and a Metasploit module. The Metasploit module (nextjs_unauth_rce_cve_2026_75604.rb) implements the complete attack chain: build ID extraction, manifest leakage via path traversal, AES-GCM key decryption, malicious Server Action payload construction, and RCE delivery — all without authentication (Metasploit, PoC rafabd1). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.0106 (low probability of exploitation in the near term), though the availability of weaponized tooling significantly elevates practical risk (Feedly). Cloudflare deployed emergency WAF rules on August 26, 2026, indicating the threat was considered serious enough for immediate network-level mitigation (Cloudflare).

1. Reconnaissance: Identify internet-facing Next.js applications running on Windows servers (versions 13.4.0–15.5.23 or 16.0.0–16.3.2) using Shodan, Censys, or HTTP fingerprinting (e.g., X-Powered-By: Next.js headers, /_next/ path responses).
2. Extract Build ID: Send a GET request to the target's root page and parse the HTML response for __next_f.push() script tags, extracting the 'b' (build ID) field from the JSON state chunks.
3. Craft path traversal request: Construct a GET request to /_next/data/[BUILD_ID]/[PAGES_ROUTER_ROUTE]/server-reference-manifest.json with URL-encoded Windows path separators (..%5C repeated based on route depth) to escape the cache root directory. Alternatively, first trigger cache population by requesting /app-cache/..%5C..%5Cserver-reference-manifest.
4. Leak the encryption key: Parse the JSON response from the traversal request to extract the encryptionKey field (Base64-encoded AES key) from server-reference-manifest.json.
5. Discover Server Actions: Send a GET request to a page with a Server Action form, parse input elements with $ACTION_REF_* and $ACTION_*:0 names to extract action IDs and valid form field names.
6. Forge malicious payload: Construct a flight string containing a constructor chain injection (1:{}\n0:["$1:constructor:constructor"]\n), prepend the action ID, and encrypt the result using AES-GCM with the leaked key (IV prepended, auth tag appended), then Base64-encode the result.
7. Send exploit POST request: Submit a multipart/form-data POST to the action endpoint with the encrypted bound args fields ($ACTION_REF_*, $ACTION_*:0, $ACTION_*:1, $ACTION_*:2) and inject a JavaScript payload (process.mainModule.require('child_process').exec(CMD)) encoded as String.fromCharCode() bytes into a form field value.
8. Achieve RCE: The server decrypts and evaluates the forged Server Action, executing the attacker's command as the Next.js application process (Metasploit, Checkmarx).

• Network: Unusual GET requests to /_next/data/[BUILD_ID]/*/server-reference-manifest.json containing %5C (URL-encoded backslash) or ..%5C sequences in the path; POST requests to Server Action endpoints with unusually large or Base64-encoded $ACTION_* multipart fields; outbound connections from the Node.js process to attacker-controlled IPs.
• Logs: Next.js access logs showing requests with %5C or %5c in dynamic route segments; HTTP 200 responses to /_next/data/ paths containing server-reference-manifest; repeated requests to the same dynamic route with varying encoded path separators.
• File System: Unexpected files written to the Next.js server directory or system temp directories by the Node.js process; new scheduled tasks or startup entries created under the application service account.
• Process: Unusual child processes spawned by the Node.js/Next.js process (e.g., cmd.exe, powershell.exe, whoami.exe); network connections initiated by node.exe to external IPs not associated with normal application dependencies (Feedly, Metasploit).

Vercel released patched versions 15.5.24 and 16.3.3 on August 25, 2026, which add backslash escaping in escapePathDelimiters.ts and a path boundary check in file-system-cache.ts that throws an error if the resolved cache path escapes the root directory. There is no known workaround for Windows-hosted applications — immediate upgrade is the only remediation (GitHub Advisory, v15.5.24 Release, v16.3.3 Release). If immediate patching is not possible, organizations should restrict network access to affected Next.js applications, deploy WAF rules blocking requests containing %5C or %5c in /_next/data/ paths (Cloudflare deployed emergency rules on August 26, 2026), or migrate Windows-hosted deployments to Linux/container environments where the vulnerability does not apply (Cloudflare, Feedly).

Vercel published the security advisory and patched releases simultaneously on August 25, 2026, with an accompanying blog post on the Next.js security release (Next.js Blog). Checkmarx published a detailed technical write-up titled "React2Shell2" analyzing the pre-auth RCE chain on Windows servers (Checkmarx). Fortbridge released independent research confirming the path traversal to RCE chain (Fortbridge). The vulnerability received broad coverage from The Hacker News, Heise, CyberSecurityNews, and others, with community discussion on Reddit and Mastodon highlighting the Windows-specific nature of the flaw and the availability of weaponized PoCs. Rapid7 highlighted the Metasploit module addition in their wrap-up blog, noting the complete exploit chain (Rapid7).