CVE-2026-94485CWE-346

CVE-2026-94485

Medium · published October 2, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
6.4
In the wild
Unconfirmed
What it is

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00173 · 6.4th percentile
Weakness
CWE-346 · Origin Validation Error
Published
2026-10-02T20:16Z
Affected products (1)
ProductVersionsFixed in
vercel/next.js≥ 16.0.0, < 16.3.816.3.8
References (3)
https://github.com/vercel/next.js/commit/2d9f50a409312696145b82b3157aadb6b1fef476 · [email protected]https://github.com/vercel/next.js/releases/tag/v16.3.8 · [email protected]https://github.com/vercel/next.js/security/advisories/GHSA-f87g-xv8r-7p7x · [email protected]
EPSS history
Timeline
  • 04 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 02 OCT 15:23Z
    Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
    cvelistv5