Windows Next.js RCE Exploit Analyzer & Patch Inspector

Deployment Parameters

HOST-SPEC

Target Operating System

Next.js Framework Version

Hosting Mode Runtime

Path & Separator Sanitization

Untrusted Input Routes Exposed API routes or Server Actions accepting dynamic paths/actions

Benchmark Presets

CVE Context: Under Windows directory separators (\ vs /), unsanitized internal dispatch in vulnerable Next.js runtimes enables arbitrary process injection via parameter normalization flaws.

Vulnerability Status

CRITICAL RISK

Severe remote code execution risk detected.

CVSS 3.1 Base Score

9.8

CVE-2026-75604 (Remote / Low Complexity)

Exploit Surface Factor

12 Routes

Windows cmd.exe dispatch accessible

Emergency Patch Remediation Directive

Upgrade Next.js immediately to >=14.2.18 or >=15.0.4 and enforce strict path validation.

Bump package.json to patch release (>=14.2.18 / >=15.0.4) and rebuild Next standalone bundle.
Apply reverse-proxy firewall rules stripping backslash (%5C / \) from incoming URL paths.
Isolate Windows execution service account privileges; revoke cmd.exe / PowerShell spawn privileges.

Payload Injection Suite

INTERACTIVE POC

Test specific Windows command injection vectors against the current Next.js environment parser:

UNC Path / Backslash Bypass Path Traversal

GET /_next/image?url=..%5C..%5Cwindows%5Csystem32%5Ccmd.exe

ChildProcess Shell Metachar Injection Command Exec

POST /api/generate?template=&whoami&dir

NTFS Stream & 8.3 Short Name Probe File Hijack

GET /api/documents/REPORT~1.BAT::$DATA

Real-Time Diagnostic Console

[INFO] Diagnostic Console Initialized. Target: Windows Server 2022

[AUDIT] Next.js 14.2.5 standalone instance detected on Win32 platform.

[VULN] CVE-2026-75604 MATCH: Windows path separator normalization flaw active.

[ALERT] Arbitrary command execution achievable via unescaped child process handles.

[DIRECTIVE] Upgrade required: >=14.2.18 or >=15.0.4.