CVE-2026-94485

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-94485
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94485.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-94485
Aliases
  • GHSA-f87g-xv8r-7p7x
Published
2026-10-02T15:23:29Z
Modified
2026-10-04T02:47:15Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
Details

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-346"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94485.json"
}
References

Affected packages

Git / github.com/vercel/next.js

Affected ranges

Type
GIT
Repo
https://github.com/vercel/next.js
Events
Introduced
950609f96f694c5475d18cd2d72a0052ca04d4b9
Fixed
2d9f50a409312696145b82b3157aadb6b1fef476
Fixed
b0fad0d45eb4c4430fda5eeeb442e8a5af08a5f6
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "16.0.0"
        },
        {
            "fixed":  "16.3.8"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v16.*
v16.0.0
v16.0.1
v16.0.1-canary.0
v16.0.1-canary.1
v16.0.1-canary.2
v16.0.1-canary.3
v16.0.1-canary.4
v16.0.1-canary.5
v16.0.1-canary.6
v16.0.2-canary.0
v16.0.2-canary.1
v16.0.2-canary.10
v16.0.2-canary.11
v16.0.2-canary.12
v16.0.2-canary.13
v16.0.2-canary.14
v16.0.2-canary.15
v16.0.2-canary.16
v16.0.2-canary.17
v16.0.2-canary.18
v16.0.2-canary.19
v16.0.2-canary.2
v16.0.2-canary.20
v16.0.2-canary.21
v16.0.2-canary.22
v16.0.2-canary.23
v16.0.2-canary.24
v16.0.2-canary.25
v16.0.2-canary.26
v16.0.2-canary.27
v16.0.2-canary.28
v16.0.2-canary.29
v16.0.2-canary.3
v16.0.2-canary.30
v16.0.2-canary.31
v16.0.2-canary.32
v16.0.2-canary.33
v16.0.2-canary.34
v16.0.2-canary.4
v16.0.2-canary.5
v16.0.2-canary.6
v16.0.2-canary.7
v16.0.2-canary.8
v16.0.2-canary.9
v16.1.0
v16.1.0-canary.0
v16.1.0-canary.1
v16.1.0-canary.10
v16.1.0-canary.11
v16.1.0-canary.12
v16.1.0-canary.13
v16.1.0-canary.14
v16.1.0-canary.15
v16.1.0-canary.16
v16.1.0-canary.17
v16.1.0-canary.18
v16.1.0-canary.19
v16.1.0-canary.2
v16.1.0-canary.20
v16.1.0-canary.21
v16.1.0-canary.22
v16.1.0-canary.23
v16.1.0-canary.24
v16.1.0-canary.25
v16.1.0-canary.26
v16.1.0-canary.27
v16.1.0-canary.28
v16.1.0-canary.29
v16.1.0-canary.3
v16.1.0-canary.30
v16.1.0-canary.31
v16.1.0-canary.32
v16.1.0-canary.33
v16.1.0-canary.34
v16.1.0-canary.4
v16.1.0-canary.5
v16.1.0-canary.6
v16.1.0-canary.7
v16.1.0-canary.8
v16.1.0-canary.9
v16.1.1-canary.0
v16.1.1-canary.1
v16.1.1-canary.10
v16.1.1-canary.11
v16.1.1-canary.12
v16.1.1-canary.13
v16.1.1-canary.14
v16.1.1-canary.15
v16.1.1-canary.16
v16.1.1-canary.17
v16.1.1-canary.18
v16.1.1-canary.19
v16.1.1-canary.2
v16.1.1-canary.20
v16.1.1-canary.21
v16.1.1-canary.22
v16.1.1-canary.23
v16.1.1-canary.24
v16.1.1-canary.25
v16.1.1-canary.26
v16.1.1-canary.27
v16.1.1-canary.28
v16.1.1-canary.29
v16.1.1-canary.3
v16.1.1-canary.30
v16.1.1-canary.31
v16.1.1-canary.32
v16.1.1-canary.33
v16.1.1-canary.34
v16.1.1-canary.35
v16.1.1-canary.36
v16.1.1-canary.4
v16.1.1-canary.5
v16.1.1-canary.6
v16.1.1-canary.7
v16.1.1-canary.8
v16.1.1-canary.9
v16.2.0
v16.2.0-canary.0
v16.2.0-canary.1
v16.2.0-canary.10
v16.2.0-canary.100
v16.2.0-canary.101
v16.2.0-canary.102
v16.2.0-canary.103
v16.2.0-canary.104
v16.2.0-canary.11
v16.2.0-canary.12
v16.2.0-canary.13
v16.2.0-canary.14
v16.2.0-canary.15
v16.2.0-canary.16
v16.2.0-canary.17
v16.2.0-canary.18
v16.2.0-canary.19
v16.2.0-canary.2
v16.2.0-canary.20
v16.2.0-canary.21
v16.2.0-canary.22
v16.2.0-canary.23
v16.2.0-canary.24
v16.2.0-canary.25
v16.2.0-canary.26
v16.2.0-canary.27
v16.2.0-canary.28
v16.2.0-canary.29
v16.2.0-canary.3
v16.2.0-canary.30
v16.2.0-canary.31
v16.2.0-canary.32
v16.2.0-canary.33
v16.2.0-canary.34
v16.2.0-canary.35
v16.2.0-canary.36
v16.2.0-canary.37
v16.2.0-canary.38
v16.2.0-canary.39
v16.2.0-canary.4
v16.2.0-canary.40
v16.2.0-canary.41
v16.2.0-canary.42
v16.2.0-canary.43
v16.2.0-canary.44
v16.2.0-canary.45
v16.2.0-canary.46
v16.2.0-canary.47
v16.2.0-canary.48
v16.2.0-canary.49
v16.2.0-canary.5
v16.2.0-canary.50
v16.2.0-canary.51
v16.2.0-canary.52
v16.2.0-canary.53
v16.2.0-canary.54
v16.2.0-canary.55
v16.2.0-canary.56
v16.2.0-canary.57
v16.2.0-canary.58
v16.2.0-canary.59
v16.2.0-canary.6
v16.2.0-canary.60
v16.2.0-canary.61
v16.2.0-canary.62
v16.2.0-canary.63
v16.2.0-canary.64
v16.2.0-canary.65
v16.2.0-canary.66
v16.2.0-canary.67
v16.2.0-canary.68
v16.2.0-canary.69
v16.2.0-canary.7
v16.2.0-canary.70
v16.2.0-canary.71
v16.2.0-canary.72
v16.2.0-canary.73
v16.2.0-canary.74
v16.2.0-canary.75
v16.2.0-canary.76
v16.2.0-canary.77
v16.2.0-canary.78
v16.2.0-canary.79
v16.2.0-canary.8
v16.2.0-canary.80
v16.2.0-canary.81
v16.2.0-canary.82
v16.2.0-canary.83
v16.2.0-canary.84
v16.2.0-canary.85
v16.2.0-canary.86
v16.2.0-canary.87
v16.2.0-canary.88
v16.2.0-canary.89
v16.2.0-canary.9
v16.2.0-canary.90
v16.2.0-canary.91
v16.2.0-canary.92
v16.2.0-canary.93
v16.2.0-canary.94
v16.2.0-canary.95
v16.2.0-canary.96
v16.2.0-canary.97
v16.2.0-canary.98
v16.2.0-canary.99
v16.2.1-canary.0
v16.2.1-canary.1
v16.2.1-canary.10
v16.2.1-canary.11
v16.2.1-canary.12
v16.2.1-canary.13
v16.2.1-canary.14
v16.2.1-canary.15
v16.2.1-canary.16
v16.2.1-canary.17
v16.2.1-canary.18
v16.2.1-canary.19
v16.2.1-canary.2
v16.2.1-canary.20
v16.2.1-canary.21
v16.2.1-canary.22
v16.2.1-canary.23
v16.2.1-canary.24
v16.2.1-canary.25
v16.2.1-canary.26
v16.2.1-canary.27
v16.2.1-canary.28
v16.2.1-canary.29
v16.2.1-canary.3
v16.2.1-canary.30
v16.2.1-canary.31
v16.2.1-canary.32
v16.2.1-canary.33
v16.2.1-canary.34
v16.2.1-canary.35
v16.2.1-canary.36
v16.2.1-canary.37
v16.2.1-canary.38
v16.2.1-canary.39
v16.2.1-canary.4
v16.2.1-canary.40
v16.2.1-canary.41
v16.2.1-canary.42
v16.2.1-canary.43
v16.2.1-canary.44
v16.2.1-canary.45
v16.2.1-canary.46
v16.2.1-canary.5
v16.2.1-canary.6
v16.2.1-canary.7
v16.2.1-canary.8
v16.2.1-canary.9
v16.3.0
v16.3.0-canary.0
v16.3.0-canary.1
v16.3.0-canary.10
v16.3.0-canary.100
v16.3.0-canary.101
v16.3.0-canary.102
v16.3.0-canary.103
v16.3.0-canary.104
v16.3.0-canary.105
v16.3.0-canary.106
v16.3.0-canary.107
v16.3.0-canary.11
v16.3.0-canary.12
v16.3.0-canary.13
v16.3.0-canary.14
v16.3.0-canary.15
v16.3.0-canary.16
v16.3.0-canary.17
v16.3.0-canary.18
v16.3.0-canary.19
v16.3.0-canary.2
v16.3.0-canary.20
v16.3.0-canary.21
v16.3.0-canary.22
v16.3.0-canary.23
v16.3.0-canary.24
v16.3.0-canary.25
v16.3.0-canary.26
v16.3.0-canary.27
v16.3.0-canary.28
v16.3.0-canary.29
v16.3.0-canary.3
v16.3.0-canary.30
v16.3.0-canary.31
v16.3.0-canary.32
v16.3.0-canary.33
v16.3.0-canary.34
v16.3.0-canary.35
v16.3.0-canary.36
v16.3.0-canary.37
v16.3.0-canary.38
v16.3.0-canary.39
v16.3.0-canary.4
v16.3.0-canary.40
v16.3.0-canary.41
v16.3.0-canary.42
v16.3.0-canary.43
v16.3.0-canary.44
v16.3.0-canary.45
v16.3.0-canary.46
v16.3.0-canary.47
v16.3.0-canary.48
v16.3.0-canary.49
v16.3.0-canary.5
v16.3.0-canary.50
v16.3.0-canary.51
v16.3.0-canary.52
v16.3.0-canary.53
v16.3.0-canary.54
v16.3.0-canary.55
v16.3.0-canary.56
v16.3.0-canary.57
v16.3.0-canary.58
v16.3.0-canary.59
v16.3.0-canary.6
v16.3.0-canary.60
v16.3.0-canary.61
v16.3.0-canary.62
v16.3.0-canary.63
v16.3.0-canary.64
v16.3.0-canary.65
v16.3.0-canary.66
v16.3.0-canary.67
v16.3.0-canary.68
v16.3.0-canary.69
v16.3.0-canary.7
v16.3.0-canary.70
v16.3.0-canary.71
v16.3.0-canary.72
v16.3.0-canary.73
v16.3.0-canary.74
v16.3.0-canary.75
v16.3.0-canary.76
v16.3.0-canary.77
v16.3.0-canary.78
v16.3.0-canary.79
v16.3.0-canary.8
v16.3.0-canary.80
v16.3.0-canary.81
v16.3.0-canary.82
v16.3.0-canary.83
v16.3.0-canary.84
v16.3.0-canary.85
v16.3.0-canary.86
v16.3.0-canary.87
v16.3.0-canary.88
v16.3.0-canary.89
v16.3.0-canary.9
v16.3.0-canary.90
v16.3.0-canary.91
v16.3.0-canary.92
v16.3.0-canary.93
v16.3.0-canary.94
v16.3.0-canary.95
v16.3.0-canary.96
v16.3.0-canary.97
v16.3.0-canary.98
v16.3.0-canary.99
v16.3.0-preview.10
v16.3.0-preview.4
v16.3.0-preview.5
v16.3.0-preview.6
v16.3.0-preview.7
v16.3.0-preview.8
v16.3.0-preview.9
v16.3.1
v16.3.2
v16.3.3
v16.3.4
v16.3.5
v16.3.6
v16.3.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94485.json"