criticalnextCVE-2026-75604
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
Affected versions
>= 13.4.0, < 15.5.24, fixed in 15.5.24>= 16.0.0, < 16.3.3, fixed in 16.3.3
Published 2026-09-08. Last checked 2026-11-01. Read the source advisory