Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next
    dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site
    requests. A malicious website visited by a developer can reach the endpoint and read the project's disk
    location, source code snippets from error reports, route inventory, and development logs. Production
    deployments do not serve this endpoint. This issue is fixed in version 16.3.8. (CVE-2026-94486)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next     dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site     requests. A malicious website visited by a developer can reach the endpoint and read the project's disk     location, source code snippets from error reports, route inventory, and development logs. Production     deployments do not serve this endpoint. This issue is fixed in version 16.3.8. (CVE-2026-94486)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
474015	Chainguard: zitadel-4-login: security update to 4.19.4-r3	Tenable Cloud Security	Chainguard Local Security Checks	Local	low
474015	Chainguard: zitadel-4-login: security update to 4.19.4-r3	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	low
474007	Echo: next: security update to 16.3.8	Tenable Cloud Security	Echo Local Security Checks	Local	low
474007	Echo: next: security update to 16.3.8	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
473796	SCA: security update for next (GHSA-39w2-rjm5-chcv)	Tenable Cloud Security	SCA Checks	Local	low
473796	SCA: security update for next (GHSA-39w2-rjm5-chcv)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
362700	Linux Distros Unpatched Vulnerability : CVE-2026-94486	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-94486

low

Tenable Plugins

low

low

low

low

low

low

low