Topic

Cve 2026 94486

Coverage tagged cve 2026 94486.

Articles: 1
Desk: 1

Data graphic: Next.js dev server MCP flaw CVE-2026-94486, rated CVSS 4.0 2.3 Low, with a FIXED stamp; fixed in Next.js 16.3.8, with no exploitation reported.

watchExploits Cve 2026 94486

Next.js Dev Server MCP Flaw CVE-2026-94486 Lets Malicious Sites Read Source Snippets and Logs

Next.js 16's next dev MCP endpoint skipped origin checks, letting a visited site read disk paths, source snippets, routes and logs. Low severity; fixed in 16.3.8.

Oct 2 · 5 min