CVE-2026-75604

CVE-2026-75604 RCE PoC Python proof of concept for CVE-2026-75604, an unauthenticated remote command execution vulnerability in Windows-hosted Next.js applications that use both the Pages Router and App Router without Cache Components. Demonstration Requirements Next.js =13.4 =16.0 16.3.3 Native...

EUVD-2026-107413

Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a javascript: URL prefixed with an ASCII control character executes from when pages is disabled...

CVE-2026-114130

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to to is prefixed with an ASCII C0 control character. Th...

CVE-2026-114130 Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to to is prefixed with an ASCII C0 control character. Th...

CVE-2026-114130

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to to is prefixed with an ASCII C0 control character. Th...

CVE-2026-114130

The Nuxt web development framework for Vue.js is vulnerable to a cross-site scripting (XSS) issue prior to version 4.6.0 . When the pages feature is disabled, the no-pages router incorrectly classifies an attacker-controlled input as an internal route if it is prefixed with an ASCII C0 control ch...

CVE-2026-114130 Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to to is prefixed with an ASCII C0 control character. Th...

CVE-2026-114130 Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to to is prefixed with an ASCII C0 control character. Th...

PT-2026-120733

Name of the Vulnerable Software and Affected Versions Nuxt versions prior to 4.6.0 Description An incomplete fix allows applications with pages disabled to render a script-capable URL through NuxtLink. This occurs when attacker-controlled input bound to the to variable is prefixed with an ASCII C...

K000163659: Next.js vulnerability CVE-2026-75604

Security Advisory Description Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route...

EUVD-2026-91670

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications...

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

Self-hosted Next.js applications that use the Pages Router with statically generated SSG or incrementally regenerated ISR pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is...

GHSA-4JQV-MC3X-M676 Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

Self-hosted Next.js applications that use the Pages Router with statically generated SSG or incrementally regenerated ISR pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is...

CVE-2026-94543

A flaw was found in Next.js. In self-hosted applications using the Pages Router with static generation or Incremental Static Regeneration ISR, response cache entries are not sufficiently bound to their source route. A remote attacker can exploit this issue by sending crafted requests to replace a...

CVE-2026-94543

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...

CVE-2026-94543 Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...

CVE-2026-94543

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...

CVE-2026-94543 Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...

CVE-2026-94543

The Next.js framework (versions 15.0.0 through 15.5.27 and 16.3.8 ) is vulnerable to cache poisoning in self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration (ISR) pages. The root cause is that response cache entries are not sufficiently boun...

CVE-2026-94543 Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...