Is CVE-2026-94485 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94485 being exploited in the wild.

How severe is CVE-2026-94485?

Medium severity, with a CVSS score of 5.3, published 2 October 2026.

Which products and versions are affected?

next (npm) >= 16.0.0, < 16.3.8, SEMVER:introduced=16.0.0,fixed=16.3.8; Vercel Next.js 16.0.0 to 16.3.7.

Is there a fix for CVE-2026-94485?

Yes. next (npm): upgrade to 16.3.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-94485 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-94485?

Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94485: Vercel Next.js MCP endpoint information disclosure

Q: Is there a fix for CVE-2026-94485?

Yes. next (npm): upgrade to 16.3.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-94485 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-94485?

Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94485 · Severity: medium · CVSS 5.3 · Published 2026-10-02

Next.js is a React framework for building full-stack web applications; the development server includes a Model Context Protocol (MCP) endpoint that developers use locally during development. From versions 16.0.0 to 16.3.7, this endpoint does not reliably block cross-site requests, allowing a malicious website visited by a developer to read sensitive information including the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments are not affected.

Technologies: next (npm), Vercel Next.js. Vendors: npm, Vercel.

Quick answers

Is CVE-2026-94485 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94485 being exploited in the wild.
How severe is CVE-2026-94485?: Medium severity, with a CVSS score of 5.3, published 2 October 2026.
Which products and versions are affected?: next (npm) >= 16.0.0, < 16.3.8, SEMVER:introduced=16.0.0,fixed=16.3.8; Vercel Next.js 16.0.0 to 16.3.7.
Is there a fix for CVE-2026-94485?: Yes. next (npm): upgrade to 16.3.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-94485 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-94485?: Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

next (npm): upgrade to 16.3.8 or later
```
npm install next@16.3.8
```

Technical details

The vulnerability is an information disclosure issue in the next dev development server where the MCP middleware lacks sufficient DNS rebinding and cross-site request protections. An attacker can craft a malicious website that, when visited by a developer using the development server, makes requests to the local MCP endpoint to exfiltrate sensitive project metadata and source code details. The issue affects only development builds; production is unaffected.

Affected products

Vercel Next.js 16.0.0 to 16.3.7

Identifiers

CVE-2026-94485
GHSA-f87g-xv8r-7p7x

Timeline

2026-10-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.