CVE-2026-94486: Next.js Development Server Information Disclosure Vulnerability
Summary
CVE-2026-94486: Next.js has information disclosure in development server's Model Context Protocol endpoint. Affects next versions >= 16.0.0, < 16.3.8. Fixed in 16.3.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Next.js is a popular open-source React framework that enables developers to build server-rendered React applications with ease. It provides features such as automatic code splitting, server-side rendering, and static site generation. However, a vulnerability has been identified in the development server's Model Context Protocol endpoint, which can expose sensitive information during development.
Vulnerability Detail
The vulnerability arises from the Next.js development server (next dev) exposing a Model Context Protocol endpoint that lacks proper origin verification. This oversight allows malicious websites, which a developer may visit, to send requests to the development server and access sensitive data. This data includes the project's location on disk, snippets of source code from error reports, route inventories, and development logs. This information disclosure can lead to unauthorized access to sensitive project details, potentially compromising the security of the application being developed.
How To Fix
Latest published version: 16.4.2 as of 22 Oct 2026
npm install next@16.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
16.3.8
This is the first release that contains the fix.
npm install next@16.3.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers should avoid using the development server (next dev) in environments where they may visit untrusted websites. Additionally, consider using a local network or VPN to limit exposure while developing.
Conclusion
The CVE-2026-94486 vulnerability in Next.js poses a significant risk during development by exposing sensitive information through the Model Context Protocol endpoint. Developers are advised to update to the patched version 16.3.8 or implement workarounds to mitigate the risk until they can upgrade.
See every vulnerability recorded for next →
FAQ
CVE-2026-94486 is a vulnerability in the Next.js development server that allows information disclosure through its Model Context Protocol endpoint.
If you are running your application using next dev, a malicious website could potentially access sensitive development data, including source code and project paths.
The vulnerability affects Next.js versions from 16.0.0 up to, but not including, 16.3.8.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.4, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for next.
