cve-2026-75604

CVE-2026-75604 - Next.js 경로 탐색 → RCE Windows · 연구 랩 CVE-2026-75604 재현 랩 및 익스플로잇 도구 모음입니다. 이는 Windows 호스트에 영향을 주는 Next.js 증분 캐시의 인증되지 않은 경로 탐색 취약점입니다. 이스케이프되지 않은 단일 백슬래시로 공격자는 캐시 디렉터리 외부의 파일을 읽고 쓸 수 있으며, 특정 버전과 앱 구조에서는 인증되지 않은 원격 코드 실행 으로 이어집니다. Fortbridge의 연구. 전체 문서: CVE-2026-75604 재현 블로그 링크 - 게시...

EUVD-2026-69702

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers...

Exploit for CVE-2026-75604

CVE-2026-75604 - Next.js path traversal → RCE Windows · rese...

CVE-2026-75604

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing...

CVE-2026-75604 Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing...

Improper Encoding or Escaping of Output

Overview next is a react framework. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the IncrementalCache.generateCacheKey function in next/dist/server/lib/incremental-cache. An attacker can make a server-side fetch return a cached response body from...