---
id: "CVE-2026-94486"
page: "https://infrastack.ai/live/CVE-2026-94486"
kind: "vulnerability"
aliases: ["CVE-2026-94486", "GHSA-39w2-rjm5-chcv"]
title: "Next.js has information disclosure in development server's Model Context Protocol endpoint"
severity: "medium"
cvss: 5.4
epss: 0.00114
exploited: false
status: "open"
category: "package"
products: [{"name": "next", "fixed": ["16.3.?"], "affected": ">= 16.0.0", "ecosystem": "npm"}, {"name": "next", "fixed": ["16.3.8"], "affected": ">= 16.0.0, < 16.3.8", "ecosystem": "npm"}, {"name": "vercel next.js", "fixed": ["16.3.8"], "affected": ">= 16.0.0, < 16.3.8", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["cwe-346", "developers", "mcp", "next.js", "npm", "package"]
not_affected_if: ["no-next-dev", "production-only", "static-export"]
published_at: "2026-09-30T16:14:15+00:00"
first_seen_at: "2026-11-09T22:53:15+00:00"
updated_at: "2026-11-09T23:10:12+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/vercel/next.js/security/advisories/GHSA-39w2-rjm5-chcv", "first_seen_at": "2026-11-09T22:53:15+00:00"}, {"source": "ghsa", "url": "https://github.com/advisories/GHSA-39w2-rjm5-chcv", "first_seen_at": "2026-11-09T22:57:50+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94486", "first_seen_at": "2026-11-09T23:10:12+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00114, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-94486"}]
---

# Next.js has information disclosure in development server's Model Context Protocol endpoint

Link for people: https://infrastack.ai/live/CVE-2026-94486 (this .md is for agents)

The Next.js development server exposes a Model Context Protocol endpoint that does not check which website sends a request. A malicious page open in the developer's browser can read the project's disk path, source snippets from error reports, the route list and development logs.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:next affected >= 16.0.0 fixed 16.3.?
- npm:next affected >= 16.0.0, < 16.3.8 fixed 16.3.8
- vendor:vercel next.js affected >= 16.0.0, < 16.3.8 fixed 16.3.8

## How to check

- Run `next --version` in the project and check whether it is `16.0.0` or later and below the fixed version.
- Check whether the project starts the dev server with `next dev` on a machine a browser can reach.
- Look at the `next` version in `package.json` and the lockfile.

## Fix

- next: `16.3.8`

## Timeline

- 2026-11-09T22:53:15+00:00 ghsa-repo https://github.com/vercel/next.js/security/advisories/GHSA-39w2-rjm5-chcv
- 2026-11-09T22:57:50+00:00 ghsa https://github.com/advisories/GHSA-39w2-rjm5-chcv
- 2026-11-09T23:10:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94486

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/vercel/next.js/security/advisories/GHSA-39w2-rjm5-chcv
- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/vercel/next.js/security-advisories/GHSA-39w2-rjm5-chcv
- [fix] Patch: github.com https://github.com/vercel/next.js/commit/2d9f50a409312696145b82b3157aadb6b1fef476
- [fix] Release notes: github.com https://github.com/vercel/next.js/releases/tag/v16.3.8

## From the sources

<!-- https://linear.app/vercel/issue/NSEC-277 -->

The Next.js development server (`next dev`) exposes a Model Context Protocol endpoint that does not verify which website a request originates from, allowing a malicious website visited by the developer to read sensitive development data — including the project's location on disk, source code snippets from error reports, the route inventory, and development logs. Only applications run with `next dev` are affected. Production deployments do not serve this endpoint.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_