CriticalGHSA-p293-qw3h-jr36CVE-2026-75604
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
Published 8 Sept 2026 · Updated 8 Sept 2026
Affected packages
nextnpm
- Affected
- >=13.4.0 <15.5.24
- Fixed in
- 15.5.24
Update to the fixed version for your release line, for example:
npm install next@15.5.24nextnpm
- Affected
- >=16.0.0 <16.3.3
- Fixed in
- 16.3.3
Update to the fixed version for your release line, for example:
npm install next@16.3.3Details
Impact
A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.
Workaround
There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows.
Is GHSA-p293-qw3h-jr36 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected next, and gives you the command that fixes it.
References
- Linkgithub.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36
- Advisorynvd.nist.gov/vuln/detail/CVE-2026-75604
- Linkgithub.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b
- Linkgithub.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3
- Packagegithub.com/vercel/next.js
- Linkgithub.com/vercel/next.js/releases/tag/v15.5.24
- Linkgithub.com/vercel/next.js/releases/tag/v16.3.3
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.