ROOT-APP-NPM-CVE-2026-75604 CVE-2026-75604 in next - Patched by Root

Root has patched CVE-2026-75604 in the next package for Root:npm. Multiple fixed versions available...

CVE-2026-75604 vulnerabilities

Vulnerabilities for packages: keep-fips, keep, zitadel, peerdb-ui...

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +1066 more potentially affected by CVE-2026-75604 via next (>=16.0.0, <=16.3.2)

next NPM version =16.0.0, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: CVE-2026-75604 Source advisory:...

Next.js Unauthenticated RCE on Windows Servers

This module exploits a Remote Code Execution RCE vulnerability in Next.js applications hosted on Windows servers. Specifically crafted requests can execute arbitrary code on the target server. The affected versions include releases from 13.4.0 up to 15.5.24, and 16.0.0 up to 16.3.3, utilizing bot...

CVE-2026-75604

creationtimestamp| type| source ---|---|--- 2026-08-25 22:00:03+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/99693 2026-08-26 00:00:07+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/99693 2026-08-26 01:58:09+00:00| seen|...

PT-2026-81520

Name of the Vulnerable Software and Affected Versions Next.js versions 13.4.0 through 15.5.23 Next.js versions 16.0.0 through 16.3.2 Description Two unauthenticated remote code execution issues affect Next.js. The first issue occurs on Windows-hosted servers using Pages Router or App Router witho...