UpHeron
All vulnerabilities

npm

CVE-2026-75604

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

Severity
Critical 9.0
Published
8 Sept 2026
Last changed
8 Sept 2026
Added to UpHeron
14 Oct 2026
Fixed in
15.5.24, 16.3.3
Also known as
GHSA-p293-qw3h-jr36
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
Next.jsnpm · osv:npm:next
  • From 13.4.0 before 15.5.24
  • From 16.0.0 before 16.3.3

References