Next.js CVE-2026-75604 does not affect every Next.js deployment simply because its package version falls inside a vulnerable range. Vercel describes a Critical vulnerability affecting specific Windows-hosted applications under defined routing and cache conditions. The affected release ranges are >=13.4 and <15.5.24, and >=16.0 and <16.3.3.
Direct answer: first check the Next.js version actually running in production. If it falls inside one of the affected ranges, then check whether the deployment is hosted on Windows and matches the affected application conditions described by Vercel. Vercel lists 15.5.24 and 16.3.3 as patched releases for the respective branches and says there is no known workaround for an affected Windows-hosted application.
What is CVE-2026-75604?
CVE-2026-75604 is a Critical Next.js vulnerability associated with improper pathname restriction and path traversal. Vercel’s advisory says an unauthenticated attacker can reach remote code execution when the application is running under the vulnerable Windows-hosted conditions.
The important qualification is under the vulnerable conditions. A scanner identifying an affected Next.js version is an important signal, but version matching alone does not establish that every application is exploitable.
Which Next.js versions are affected?
Vercel identifies two affected version ranges:
- >=13.4 and <15.5.24
- >=16.0 and <16.3.3
This means a project on an older 13.x, 14.x or 15.x release can still fall within the first affected range if it is at least 13.4 and below 15.5.24. A project on 16.0 through 16.3.2 falls within the second affected range.
Which versions fix CVE-2026-75604?
Vercel lists the following patched releases:
- 15.5.24 for the affected 13.x/15.x range
- 16.3.3 for the affected 16.x range
A later supported release that contains the same fix is also outside the vendor-listed vulnerable range. The practical goal is not merely to edit a package manifest; it is to ensure that the production deployment actually runs a fixed release.
How to determine whether your deployment is actually affected
Determine the version actually running on the deployed application, not only the version planned in a branch, lockfile or package manifest.
If the running version is outside both vendor-listed affected ranges, this CVE’s published version condition does not match. If it falls inside either range, continue the diagnostic.
Vercel describes this issue in Windows-hosted applications using the Windows filesystem. The reviewed advisory does not describe Linux or macOS hosts as matching this vulnerable hosting condition.
Compare the application with the Pages Router or App Router and Cache Components conditions described in Vercel’s advisory. Do not reduce the diagnosis to version alone.
Move to the fixed release for the relevant branch or a later supported release containing the fix.
After rebuilding and redeploying, confirm the production application is running the fixed version. A planned upgrade is not the same as verified remediation.
Is Windows hosting required for the published vulnerable condition?
Yes. Vercel’s advisory specifically describes the issue in Windows-hosted applications and ties the vulnerability to the Windows filesystem behavior involved in the affected request and cache path handling.
This distinction matters for teams that use the same codebase across different environments. A dependency scanner may flag a vulnerable package version everywhere, while the vendor’s exploitability conditions can depend on where and how the application actually runs.
Are Linux or macOS Next.js servers affected by this CVE?
The reviewed vendor description is Windows-specific. The evidence reviewed for this article does not establish Linux or macOS as satisfying the vulnerable host condition for CVE-2026-75604.
That does not mean Linux or macOS deployments have no security issues generally. It means TPS should not transfer this CVE’s Windows-specific vulnerable condition to other operating systems without evidence.
Why do Pages Router, App Router and Cache Components matter?
Vercel does not define exposure only through the package version. The advisory also describes affected application conditions involving the routing mode and cache behavior.
Administrators should therefore compare the actual application configuration against the vendor advisory rather than treating every Windows server with an affected Next.js package as automatically exploitable.
Is there a workaround if you cannot upgrade immediately?
Vercel states that there is no known workaround for an affected Windows-hosted application and recommends upgrading to a patched release.
That means compensating controls should not be presented as equivalent to the vendor fix. They may be useful as additional defensive layers, but they do not replace the upgrade required to remove the known vulnerable application state.
Can a WAF replace the Next.js upgrade?
No reviewed vendor evidence establishes a web application firewall as a replacement for upgrading an affected deployment. Cloudflare published detection coverage related to the vulnerability, but Vercel’s own remediation remains upgrading the affected Next.js application.
TPS therefore treats WAF coverage as a defensive layer, not as proof that the vulnerable application itself has been remediated.
What proves remediation?
A useful remediation check should verify the production-deployed Next.js version, not merely a dependency-file change.
For an organization, the evidence can include the deployed application inventory, build or release record and runtime/version confirmation showing that the affected production instance has moved to the fixed branch or a later supported release containing the patch.
If the original finding also depended on Windows hosting and application configuration, preserve that environment information with the remediation record so the security team can distinguish a vulnerable package finding from an actually exposed deployment condition.
Does a vulnerable package version prove the server was exploitable?
No. It proves that the version condition deserves investigation. The vendor-described host and application prerequisites still matter.
This is the central diagnostic distinction for CVE-2026-75604: affected version is not automatically identical to confirmed exploitable deployment.
Does installing 15.5.24 or 16.3.3 prove the server was never compromised?
No. A fixed production version establishes the current remediation state. It does not retrospectively prove that exploitation never occurred before the upgrade.
If an organization has independent evidence of suspicious activity or another reason to suspect compromise, incident investigation is a separate task from dependency remediation.
Has CVE-2026-75604 been actively exploited in the wild?
The reviewed Vercel and CERT-In primary material does not establish active in-the-wild exploitation.
Public proof-of-concept material has appeared, but public exploit code and confirmed real-world exploitation are different evidence states. TPS therefore does not describe CVE-2026-75604 as actively exploited unless a reliable source establishes that change.
What should you do if a scanner reports CVE-2026-75604?
- Identify the application and production Next.js version.
- Check whether the version is inside one of Vercel’s affected ranges.
- Confirm whether the production host is Windows-based.
- Compare the application’s routing and Cache Components state with Vercel’s affected conditions.
- If the deployment matches the vulnerable state, upgrade to the appropriate fixed branch or later supported release.
- Redeploy and verify the version actually running in production.
- Preserve the deployment and version evidence used to close the remediation ticket.
- If separate compromise evidence exists, escalate through the organization’s incident-response process rather than assuming the patch alone answers that question.
What remains unknown?
The reviewed primary evidence does not establish current victim numbers, threat-actor identity, campaign scope, geographic concentration or an authoritative campaign-specific IOC set.
It also does not establish that every deployment matching an affected package version was previously exploitable or compromised.
Verification and limitations
CONFIRMED: Vercel lists CVE-2026-75604 as a Critical vulnerability affecting specified Windows-hosted Next.js configurations.
CONFIRMED: the affected ranges are >=13.4 and <15.5.24, and >=16.0 and <16.3.3.
CONFIRMED: Vercel lists 15.5.24 and 16.3.3 as patched releases and states that no known workaround exists for affected Windows-hosted applications.
NOT ESTABLISHED: active exploitation in the wild, specific victim scope, threat-actor attribution or proof that a previously vulnerable deployment was compromised.
