Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.

A path traversal vulnerability exists in Next.js versions 13.4.0 through 15.5.23 and 16.x before 16.3.3 affecting Windows-hosted servers. The framework fails to consistently escape backslashes in route segments when constructing incremental-cache paths. Attackers can supply encoded Windows path separators via remote requests to traverse outside the intended cache root directory. This exposure can leak private build data, including the server-reference-manifest encryption key. Disclosure of this encryption key can lead to remote code execution on the affected application. The vulnerability affects applications using Pages Router or App Router without Cache Components on Windows. Affected files include escape-path-delimiters.ts and file-system-cache.ts. Fixes are available in versions 15.5.24 and 16.3.3.