Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next
    dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site
    requests. A malicious website visited by a developer can reach the endpoint and read the project's disk
    location, source code snippets from error reports, route inventory, and development logs. Production
    deployments do not serve this endpoint. This issue is fixed in version 16.3.8. (CVE-2026-94485)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next     dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site     requests. A malicious website visited by a developer can reach the endpoint and read the project's disk     location, source code snippets from error reports, route inventory, and development logs. Production     deployments do not serve this endpoint. This issue is fixed in version 16.3.8. (CVE-2026-94485)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
474016	Chainguard: zitadel-4-login: security update to 4.19.4-r3	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
474016	Chainguard: zitadel-4-login: security update to 4.19.4-r3	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
473992	Echo: next: security update to 16.3.8	Tenable Cloud Security	Echo Local Security Checks	Local	medium
473992	Echo: next: security update to 16.3.8	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
473761	SCA: security update for next (GHSA-f87g-xv8r-7p7x)	Tenable Cloud Security	SCA Checks	Local	medium
473761	SCA: security update for next (GHSA-f87g-xv8r-7p7x)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
362698	Linux Distros Unpatched Vulnerability : CVE-2026-94485	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-94485

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium