Next.js Windows Path Traversal Vulnerability

Next.js, a React framework for building full-stack web applications, is affected by a vulnerability in versions 13.4.0 to 15.5.24 and 16.3.3.

Due to inconsistent backslash escaping in route segments, remote requests can exploit Windows path separators to traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key.

This can lead to remote code execution in the affected application. The issue is fixed in versions 15.5.24 and 16.3.3.