CVE-2026-75604

About vulnerability

Impact

A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.

Workaround

There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows.

Affected product:

Next.js , React , braintrust-openai-agents , braintrust-otel , braintrust-sdk-javascript , braintrust-temporal , bufbuild/connect-es , create-next-app , expo-next-adapter , lit-labs-nextjs , mastra-braintrust , mui-material-nextjs , orama-orama , pigment-css , sb , sentry-nextjs , storybook , storybook-addon-a11y , storybook-addon-actions , storybook-addon-backgrounds , storybook-addon-controls , storybook-addon-docs , storybook-addon-essentials , storybook-addon-highlight , storybook-addon-interactions , storybook-addon-links , storybook-addon-measure , storybook-addon-outline , storybook-addon-themes , storybook-addon-toolbars , storybook-addon-viewport , storybook-angular , storybook-blocks , storybook-builder-manager , storybook-builder-vite , storybook-builder-webpack5 , storybook-channel-postmessage , storybook-channels , storybook-cli , storybook-client-logger , storybook-codemod , storybook-components , storybook-core-client , storybook-core-common , storybook-core-events , storybook-core-server , storybook-core-webpack , storybook-csf-plugin , storybook-csf-tools , storybook-docs-tools , storybook-ember , storybook-html , storybook-html-vite , storybook-html-webpack5 , storybook-instrumenter , storybook-manager , storybook-manager-api , storybook-nextjs , storybook-node-logger , storybook-preact , storybook-preact-vite , storybook-preact-webpack5 , storybook-preset-create-react-app , storybook-preset-html-webpack , storybook-preset-preact-webpack , storybook-preset-react-webpack , storybook-preset-server-webpack , storybook-preset-svelte-webpack , storybook-preset-vue3-webpack , storybook-preview , storybook-preview-api , storybook-react , storybook-react-dom-shim , storybook-react-vite , storybook-react-webpack5 , storybook-router , storybook-server , storybook-server-webpack5 , storybook-svelte , storybook-svelte-vite , storybook-svelte-webpack5 , storybook-sveltekit , storybook-telemetry , storybook-theming , storybook-types , storybook-vue3 , storybook-vue3-vite , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-vite , storybook-web-components-webpack5

Affected packages:

create-next-app @ 13.5.11 (+830 more)