CVE-2026-94486: Next.js has information disclosure in development server's Model Context Protocol endpoint
The Next.js development server (next dev) exposes a Model Context Protocol endpoint that does not verify which website a request originates from, allowing a malicious website visited by the developer to read sensitive development data — including the project's location on disk, source code snippets from error reports, the route inventory, and development logs. Only applications run with next dev are affected.
Published Oct 7, 2026
Affected packages
next
- Ecosystem
- npm
- Affected
- >= 16.0.0, < 16.3.8
- Fixed in
- 16.3.8
- Check
npm ls next
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
The Next.js development server (next dev) exposes a Model Context Protocol endpoint that does not verify which website a request originates from, allowing a malicious website visited by the developer to read sensitive development data — including the project's location on disk, source code snippets from error reports, the route inventory, and development logs. Only applications run with next dev are affected. Production deployments do not serve this endpoint.
References
- https://github.com/vercel/next.js/security/advisories/GHSA-39w2-rjm5-chcv
- https://nvd.nist.gov/vuln/detail/CVE-2026-94486
- https://github.com/vercel/next.js/commit/2d9f50a409312696145b82b3157aadb6b1fef476
- https://github.com/vercel/next.js/releases/tag/v16.3.8
- https://github.com/advisories/GHSA-39w2-rjm5-chcv
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Other MCP servers and tools vulnerabilities
All Other MCP servers and tools entriesCVE-2026-77361
obsidian-tc : Symlink read-ACL scope bypass via lexical path checks
medium4.7Oct 23, 2026CVE-2026-114126
Storybook dev server vulnerable to code injection from the local network
high8.7Oct 22, 2026CVE-2026-113731
djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool
low3.3Oct 21, 2026CVE-2026-114125
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
critical9.4Oct 21, 2026CVE-2026-111770
MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
high7.7Oct 20, 2026GHSA-953h-535j-jg2v
agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable
medium6.8Oct 19, 2026