Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.0

next framework can let attackers run code

CVE-2026-75604 · published today
Summary

The next package used in web applications had a security flaw that could allow an attacker to execute commands on your server. Root has released updated versions that fix the problem. Upgrade all next, vercel/next.js, and @rootio/next installations to the latest versions as soon as possible.

What to do
  • Update next to version 15.5.24.
  • Update next to version 16.3.3.
  • Update next to version 13.5.11-aikido.6.
  • Update rootio @rootio/next to version 13.5.11-root.io.6.
  • Update next to version 14.1.4-aikido.4.
  • Update rootio @rootio/next to version 14.1.4-root.io.4.
  • Update next to version 14.0.3-aikido.2.
  • Update rootio @rootio/next to version 14.0.3-root.io.2.
  • Update next to version 14.2.0-aikido.4.
  • Update rootio @rootio/next to version 14.2.0-root.io.4.
  • Update next to version 14.2.18-aikido.5.
  • Update rootio @rootio/next to version 14.2.18-root.io.5.
  • Update next to version 13.5.6-aikido.7.
  • Update next to version 16.3.3-aikido.1.
  • Update rootio @rootio/next to version 16.3.3-root.io.1.
Affected software
Ecosystem VendorProductAffected versions
npm – next >= 13.4.0, < 15.5.24
>= 16.0.0, < 16.3.3
Fix: upgrade to 15.5.24
– vercel next.js >= 13.4.0, < 15.5.24
Root:npm – next < 13.5.11-aikido.6
< 14.1.4-aikido.4
< 14.0.3-aikido.2
< 14.2.0-aikido.4
< 14.2.18-aikido.5
< 13.5.6-aikido.7
< 16.3.3-aikido.1
Fix: upgrade to 13.5.11-aikido.6
Root:npm rootio @rootio/next < 13.5.11-root.io.6
< 14.1.4-root.io.4
< 14.0.3-root.io.2
< 14.2.0-root.io.4
< 14.2.18-root.io.5
< 16.3.3-root.io.1
Fix: upgrade to 13.5.11-root.io.6
Original advisory text
CVE-2026-75604 in next - Patched by Root
Root has patched CVE-2026-75604 in the next package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.0 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published12 Oct 2026
Updated12 Oct 2026
First seen2 Sep 2026
Sources
CVE-2026-75604 · NVD
CVE-2026-75604 · MITRE
CVE-2026-75604 · OSV
GHSA-p293-qw3h-jr36 · GHSA
ROOT-APP-NPM-CVE-2026-75604 · OSV
Track software like this
Free during beta