CVE-2026-94486

score

0.4

cvss

5.4

epss

0.1%

published

2026-10-02

kev added

—

first seen

2026-10-21

Next.js 16.0.0 to 16.3.8 contains an information disclosure vulnerability caused by insufficient cross-site request restrictions on the Model Context Protocol endpoint in the development server, letting malicious websites accessed by developers read project disk location, source code snippets, route inventory, and development logs, exploit requires developer to visit malicious website.