security1 distinct publisher
CVE-2026-75604 hands unauthenticated RCE to anyone reaching a Windows-hosted Next.js app
The affected releases stretch back to Next.js 13.4, and for Windows self-hosters the only remedy Vercel offers is the version bump. The AVIF bug shipped in the same release at least has a config gate.
Publishers:thehackernews.com
Reality
- Evidence74
- Adoption40
- Hype gap+12
- Incentives58