NextChat proxy fallback lets unauthenticated callers make the server fetch any URL (CVE-2026-105238)
NextChat 2.16.0 and 2.16.1 let anyone make the server fetch any URL through the x-base-url header. A public PoC exists and the fix is still an open PR.
· 7 min