Description

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-09-01T22:17:12.697Z",
  "pubdate": "2026-09-01T22:17:12.697Z",
  "executiveSummary": "This vulnerability is a path traversal flaw affecting Next.js applications deployed on Windows-hosted servers. It stems from improper sanitization of backslash characters within route segments during the construction of incremental-cache file paths.\nBy supplying specially crafted, encoded Windows path separators in a remote request, an unauthenticated attacker can escape the intended cache directory boundaries. This allows unauthorized access to sensitive build-time artifacts and private server-side data.\nThe most critical risk involves the disclosure of the server-reference-manifest encryption key. Exposure of this cryptographic material significantly degrades the security posture of the application, potentially enabling remote code execution (RCE).\nThe vulnerability affects Next.js versions 13.4.0 through 15.5.24 and 16.3.3. Environments utilizing both Pages Router and App Router (specifically configurations without Cache Components) are susceptible if hosted on the Windows operating system. Organizations should prioritize updating to the fixed versions to remediate the flaw and prevent potential arbitrary code execution.",
  "technicalDetails": "The vulnerability is rooted in the insufficient escaping of path delimiters within the Next.js routing and caching logic, specifically in the files 'packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts' and 'packages/next/src/server/lib/incremental-cache/file-system-cache.ts'. On Windows-based systems, the backslash character ('\\') functions as a directory separator, distinct from the forward slash ('/') used in POSIX-compliant systems. The application fails to normalize or restrict these characters when constructing file system paths for the incremental cache.\nAn attacker can exploit this by crafting a request containing encoded Windows path separators (e.g., URL-encoded sequences that decode to backslashes). When the Next.js router processes these segments, the inadequate escaping logic fails to prevent the traversal of the directory tree. Because the incremental-cache utilizes these segments to define file paths on the local file system, the attacker can break out of the designated cache storage directory.\nThe attack flow proceeds as follows: 1. The attacker identifies an application hosted on a Windows environment. 2. The attacker submits a malicious request where the path contains character sequences that resolve to backslashes in the context of the Windows file system. 3. The vulnerable 'escape-path-delimiters.ts' logic fails to treat these as literals, allowing the 'file-system-cache.ts' module to construct a path that traverses into parent directories. 4. The application reads from or writes to files outside the intended cache root, specifically targeting sensitive files such as the server-reference-manifest. 5. Upon successful retrieval of the manifest, the attacker extracts the encryption key contained within.\nThe impact of this disclosure is severe. The server-reference-manifest encryption key is used to sign and secure server actions; access to this key allows an attacker to forge requests, manipulate server-side state, or potentially achieve remote code execution by bypassing signature verification processes intended to protect the internal API surfaces of the application. This vulnerability does not require authentication or elevated privileges, and the exploitation vector is strictly network-based, targeting the public-facing router interface of the Next.js application."
}