{"id":"CVE-2026-94486","kind":"vulnerability","aliases":["CVE-2026-94486","GHSA-39w2-rjm5-chcv"],"related":[],"title":"Next.js has information disclosure in development server's Model Context Protocol endpoint","description":"<!-- https://linear.app/vercel/issue/NSEC-277 -->\r\n\r\nThe Next.js development server (`next dev`) exposes a Model Context Protocol endpoint that does not verify which website a request originates from, allowing a malicious website visited by the developer to read sensitive development data — including the project's location on disk, source code snippets from error reports, the route inventory, and development logs. Only applications run with `next dev` are affected. Production deployments do not serve this endpoint.","summary":"The Next.js development server exposes a Model Context Protocol endpoint that does not check which website sends a request. A malicious page open in the developer's browser can read the project's disk path, source snippets from error reports, the route list and development logs.","severity":"medium","cvss":5.4,"epss":0.00114,"exploited":false,"exploited_at":null,"products":[{"name":"next","fixed":["16.3.?"],"affected":">= 16.0.0","ecosystem":"npm"},{"name":"next","fixed":["16.3.8"],"affected":">= 16.0.0, < 16.3.8","ecosystem":"npm"},{"name":"vercel next.js","fixed":["16.3.8"],"affected":">= 16.0.0, < 16.3.8","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cwe-346","developers","mcp","next.js","npm","package"],"not_affected_if":["no-next-dev","production-only","static-export"],"how_to_check":"- Run `next --version` in the project and check whether it is `16.0.0` or later and below the fixed version.\n- Check whether the project starts the dev server with `next dev` on a machine a browser can reach.\n- Look at the `next` version in `package.json` and the lockfile.","fix":"- next: `16.3.8`","status":"open","published_at":"2026-09-30T16:14:15+00:00","first_seen_at":"2026-11-09T22:53:15+00:00","triaged_at":"2026-11-09T23:01:07+00:00","updated_at":"2026-11-09T23:10:12+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T23:01:07Z","model":"claude-haiku-5-5","output":{"fix":"- next: `16.3.8`","reach":"local","title":"Next.js: dev server's MCP endpoint leaks project files to malicious websites","impact":"medium","summary":"The Next.js development server exposes a Model Context Protocol endpoint that does not check which website sends a request. A malicious page open in the developer's browser can read the project's disk path, source snippets from error reports, the route list and development logs.","audience":"developers","category":"package","nicknames":[],"who_cares":["next.js","npm","developers","mcp"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"project paths, source snippets and dev logs readable by websites","analyst_note":"Confirm the fixed version for the 16.3.x line from the ghsa-repo advisory and the patch link; the product data shows an unresolved '16.3.?' entry.","how_to_check":"- Run `next --version` in the project and check whether it is `16.0.0` or later and below the fixed version.\n- Check whether the project starts the dev server with `next dev` on a machine a browser can reach.\n- Look at the `next` version in `package.json` and the lockfile.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["production-only","static-export","no-next-dev"],"who_is_affected":"Only projects running the development server (`next dev`) are exposed; production deployments do not serve this endpoint. A developer who visits a malicious website while the dev server runs can have local development data read. Teams that never run `next dev` on a reachable machine can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000769,"input_tokens":4794,"output_tokens":580,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,22A '-346':29B '-94486':15A,23A '39w2':18A 'affect':142C 'allow':103C 'applic':136C 'browser':62B 'chcv':20A 'check':48B 'code':124C 'context':10A,42B,90C 'cve':13A,21A 'cwe':28B 'data':115C 'deploy':144C 'dev':86C,140C 'develop':6A,30B,37B,60B,79B,83C,110C,114C,133C 'disclosur':4A 'disk':68B,122C 'endpoint':12A,44B,92C,149C 'error':73B,127C 'expos':39B,87C 'ghsa':17A 'ghsa-39w2-rjm5-chcv':16A 'includ':116C 'inform':3A 'inventori':131C 'list':77B 'locat':120C 'log':80B,134C 'malici':55B,105C 'mcp':31B 'model':9A,41B,89C 'next':24A,25A,85C,139C 'next.js':1A,27A,32B,36B,82C 'npm':33B 'open':57B 'origin':101C 'packag':34B 'page':56B 'path':69B 'product':143C 'project':66B,118C 'protocol':11A,43B,91C 'read':64B,112C 'report':74B,128C 'request':53B,100C 'rjm5':19A 'rout':76B,130C 'run':137C 'send':51B 'sensit':113C 'serv':147C 'server':7A,38B,84C 'snippet':71B,125C 'sourc':70B,123C 'vercel':26A 'verifi':96C 'visit':107C 'websit':50B,98C,106C","nicknames":[],"mitigations":[],"who_affected":"Only projects running the development server (`next dev`) are exposed; production deployments do not serve this endpoint. A developer who visits a malicious website while the dev server runs can have local development data read. Teams that never run `next dev` on a reachable machine can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["next","nextjs","vercelnextjs"],"ptokens":["next","nextjs","vercel"],"labels":["cwe346","developers","mcp","medium","nextjs","npm","package","vendor"],"campaign_type":null,"search_a":"'-2026':14A,22A '-94486':15A,23A '39w2':18A 'chcv':20A 'context':10A 'cve':13A,21A 'develop':6A 'disclosur':4A 'endpoint':12A 'ghsa':17A 'ghsa-39w2-rjm5-chcv':16A 'inform':3A 'model':9A 'next':24A,25A 'next.js':1A,27A 'protocol':11A 'rjm5':19A 'server':7A 'vercel':26A","search_b":"'-346':29B 'browser':62B 'check':48B 'context':42B 'cwe':28B 'develop':30B,37B,60B,79B 'disk':68B 'endpoint':44B 'error':73B 'expos':39B 'list':77B 'log':80B 'malici':55B 'mcp':31B 'model':41B 'next.js':32B,36B 'npm':33B 'open':57B 'packag':34B 'page':56B 'path':69B 'project':66B 'protocol':43B 'read':64B 'report':74B 'request':53B 'rout':76B 'send':51B 'server':38B 'snippet':71B 'sourc':70B 'websit':50B","search_c":"'affect':142C 'allow':103C 'applic':136C 'code':124C 'context':90C 'data':115C 'deploy':144C 'dev':86C,140C 'develop':83C,110C,114C,133C 'disk':122C 'endpoint':92C,149C 'error':127C 'expos':87C 'includ':116C 'inventori':131C 'locat':120C 'log':134C 'malici':105C 'model':89C 'next':85C,139C 'next.js':82C 'origin':101C 'product':143C 'project':118C 'protocol':91C 'read':112C 'report':128C 'request':100C 'rout':130C 'run':137C 'sensit':113C 'serv':147C 'server':84C 'snippet':125C 'sourc':123C 'verifi':96C 'visit':107C 'websit':98C,106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-30T16:14:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-39w2-rjm5-chcv","url":"https://github.com/vercel/next.js/security/advisories/GHSA-39w2-rjm5-chcv","severity":"low","published_at":"2026-09-30T16:14:15+00:00","modified_at":"2026-09-30T16:14:15+00:00","first_seen_at":"2026-11-09T22:53:15+00:00","fetched_at":"2026-11-09T22:53:15+00:00","note":null},{"source":"ghsa","external_id":"GHSA-39w2-rjm5-chcv","url":"https://github.com/advisories/GHSA-39w2-rjm5-chcv","severity":"low","published_at":"2026-10-07T20:31:51+00:00","modified_at":"2026-10-07T20:31:52+00:00","first_seen_at":"2026-11-09T22:57:50+00:00","fetched_at":"2026-11-09T22:57:50+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-94486","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94486","severity":null,"published_at":"2026-10-02T16:16:51+00:00","modified_at":"2026-10-05T14:58:14+00:00","first_seen_at":"2026-11-09T23:10:12+00:00","fetched_at":"2026-11-09T23:10:12+00:00","note":null}],"documents":[{"id":110406,"url":"https://github.com/vercel/next.js/security/advisories/GHSA-39w2-rjm5-chcv","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-09-30T16:14:15+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":110781,"url":"https://api.github.com/repos/vercel/next.js/security-advisories/GHSA-39w2-rjm5-chcv","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":110769,"url":"https://github.com/vercel/next.js/commit/2d9f50a409312696145b82b3157aadb6b1fef476","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":43051,"url":"https://github.com/vercel/next.js/releases/tag/v16.3.8","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[{"type":"epss","score":0.00114,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94486"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}