CVE-2026-94485

MediumCVSS 5.3/10Last modified Oct 5, 2026

Description

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-346

Affected software

No affected versions have been published.

Timeline

Published: Oct 2, 2026
Last modified: Oct 5, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-944865.4Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a M CVE-2026-944878.1Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.CVE-2026-944888.2Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 CVE-2026-94496.3A vulnerability was identified in code-projects Employee Management System 1.0. This impacts an unknown function of the file /changepassemp.CVE-2026-944917.3A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/search_list.jsp. Executing a manipulat CVE-2026-944926.3A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.sa CVE-2026-9449310.0A vulnerability was detected in Gigatech PDV5701 1.0.31_240305_112640. This issue affects some unknown processing of the file /index.html of CVE-2026-944945.0jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the G CVE-2026-944957.1jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to mod CVE-2026-944968.3jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data CVE-2026-944978.3jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authentica CVE-2026-944986.5Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.