CVE-2026-75604: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in vercel next.js

Next.js, a React framework, contains a path traversal vulnerability (CWE-22) in its handling of route segments on Windows-hosted servers. Specifically, from versions 13.4.0 until 15.5.24 and 16.0.0 until 16.3.3, the framework does not consistently escape backslashes in route segments before constructing incremental-cache paths. This allows a remote request to supply encoded Windows path separators that traverse outside the intended cache root directory, exposing private build data such as the server-reference-manifest encryption key. Exposure of this key can enable remote code execution within the affected application. The vulnerability is addressed in Next.js versions 15.5.24 and 16.3.3.

Successful exploitation can disclose private build data including encryption keys, which can lead to remote code execution on the affected Next.js application. This represents a critical security risk with high confidentiality, integrity, and availability impacts.

Upgrade Next.js to version 15.5.24 or later if using the 13.x or 15.x series, or to version 16.3.3 or later if using the 16.x series. These versions contain the official fix for the path traversal vulnerability. No other mitigation is indicated by the vendor advisory.