Tools AI Risk Radar ai-incident-0145
Incident record
Next.js fixes development data exposed to malicious websites
- Severity
- Medium
- Status
- Patched
- Type
- Infra Vuln
- Target
- next
- Actor
- researcher
- CVE
- CVE-2026-94486
What happened
A developer visiting a malicious website while running the Next.js development server could expose project paths, error snippets, routes and logs through its MCP endpoint. The affected endpoint belongs to the development server.
next: affected >= 16.0.0, < 16.3.8; fixed in 16.3.8. The date shown is the maintainer’s original disclosure date. Its advisory assigns 5.4 under CVSS 3.1. The numerical score is 5.4 Medium; the maintainer’s own priority label is Low.
Sources
- Primary disclosuregithub.com/vercel/next.js/security/advisories/GHSA-39w2-rjm5…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026