Vulnerabilities / CVE-2026-94485

CVE-2026-94485

Published 2026-10-02 · Analyzed

CVE-2026-94485

Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

6.3 MEDIUM
CVSS 4.0 · CNA · github.com

0.2%
chance of exploitation in the next 30 days (EPSS; higher than 6% of CVEs)

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.

Scores

6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NCNA · github.com

5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NNVD

Affected packages and fixed versions

Package	Ecosystem	Fixed in
next	npm	16.3.8

Affected products

vercel next.js: ≥ 16.0.0, < 16.3.8

Weakness: CWE-346

Also known as: GHSA-f87g-xv8r-7p7x

3 references (advisories, patches, write-ups)

https://github.com/vercel/next.js/commit/2d9f50a409312696145b82b3157aadb6b1fef476 · Patch
https://github.com/vercel/next.js/releases/tag/v16.3.8 · Release Notes
https://github.com/vercel/next.js/security/advisories/GHSA-f87g-xv8r-7p7x · Vendor Advisory

Sources: NVD, CVE.org, OSV.dev, FIRST EPSS. Missing ones did not answer or have no record yet.

Look up another CVE Check your dependencies Scan a website