Next.js Discloses Unauthenticated RCE Affecting Windows-Hosted Servers (CVE-2026-75604)

What happened

Vercel published a GitHub Security Advisory (GHSA-p293-qw3h-jr36) on September 8, 2026, disclosing an unauthenticated remote code execution vulnerability in Next.js, tracked as CVE-2026-75604. According to the advisory, applications using either the Pages Router or App Router are affected when the server is hosted on a machine using a Windows filesystem and is not using Cache Component. The advisory carries a CVSS score of 9.0 and is currently listed with public proof-of-concept exploit code available. No workaround exists for affected Windows-hosted deployments — the advisory states upgrading is the only remediation.

Why it matters

Next.js is one of the most widely deployed React frameworks, and an unauthenticated RCE at this severity is significant regardless of hosting platform. The Windows-filesystem dependency narrows the blast radius to a specific hosting configuration, but any organization running Next.js on Windows-based infrastructure (IIS-fronted deployments, Windows containers, or on-prem Windows servers) should treat this as an immediate priority. With public PoC code reportedly available, the window between disclosure and opportunistic exploitation attempts is likely short.

What defenders should watch for now

• Inventory all Next.js applications and identify which are hosted on Windows-based servers or containers.
• Confirm whether affected apps use Pages Router or App Router without Cache Component, per the advisory's scoping.
• Prioritize patching/upgrading Windows-hosted Next.js instances immediately — the advisory states no workaround exists.
• Until patched, increase monitoring of web server and application logs for anomalous process creation, unexpected child processes spawned from the Node.js/Next.js runtime, or unusual file writes originating from the web application user context.
• Review edge/WAF logging for unusual request patterns targeting Next.js routes, keeping in mind exact exploitation mechanics are not detailed in the advisory at this time.

Developing situation

This is net-new intelligence based solely on the GitHub Security Advisory published today. Technical exploitation details beyond the advisory's summary are not yet confirmed, and we will update our coverage as more information becomes available. Read the original advisory here: GHSA-p293-qw3h-jr36.