CyberRota Analysis
AI-GeneratedNext.js applications using Pages Router or App Router on Windows servers are vulnerable due to improper escaping of backslashes in route segments, which can lead to unauthorized access to private build data, including sensitive encryption keys. This critical vulnerability poses a significant risk of remote code execution, making it essential for developers and organizations utilizing affected Next.js versions (13.4.0 to 15.5.23 and 16.3.2) to prioritize immediate updates to versions 15.5.24 or 16.3.3 to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.