The version of Next.js installed on the remote host is 15.0.0 prior to 15.5.27 or 16.0.0 prior to 16.3.8. It is, therefore, affected by multiple vulnerabilities:

- A Server-Side Request Forgery vulnerability in the Image Optimization API, where an attacker-controlled, allow-listed remote URL can lead to requests to private IP addresses. This issue only affects versions 16.0.0 and later. (CVE-2026-94483)

- A cache poisoning vulnerability in self-hosted applications using the Pages Router with SSG or ISR pages, allowing a page's cache entry to be replaced with content from a different route. (CVE-2026-94543)

- A cache poisoning vulnerability in applications using a root-level catch-all page together with SSG or ISR routes, leading to cross-user content substitution and persistent denial of service. (CVE-2026-94484)

- An information disclosure vulnerability in App Router metadata image routes built with webpack, which ignore the 'dynamicParams' route segment option. (CVE-2026-94485)

- An information disclosure vulnerability where pending 'use cache' fills are shared between Draft Mode and regular requests, leaking unpublished content. This issue only affects versions 16.0.0 and later. (CVE-2026-94544)

- A cache leak across root param values in nested 'use cache' functions when Cache Components are enabled. This issue only affects versions 16.0.0 and later. (CVE-2026-103004)

- An information disclosure vulnerability in the development server's Model Context Protocol endpoint, which does not verify the request origin. This issue only affects versions 16.0.0 and later. (CVE-2026-94486)

Note that the scanner has not attempted to exploit these issues but has instead relied only on application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next
    dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site
    requests. A malicious website visited by a developer can reach the endpoint and read the project's disk
    location, source code snippets from error reports, route inventory, and development logs. Production
    deployments do not serve this endpoint. This issue is fixed in version 16.3.8. (CVE-2026-94485)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Next.js 是一個用於構建全棧 Web 應用程序的 React 框架。從16.0.016.3.8直到 ，「下一個開發」開發伺服器會公開模型內容通訊協定端點，而不會可靠地限制跨網站要求。開發人員造訪的惡意網站可以到達端點並讀取專案的磁碟位置、錯誤報告中的原始程式碼片段、路由清單和開發日誌。生產部署不會為此端點提供服務。16.3.8 版已修正此問題。(CVE-2026-94485)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Next.js 是用于构建全栈 Web 应用程序的 React 框架。From 16.0.016.3.8until 的“next dev”开发服务器在未可靠限制跨站请求的情况下暴露模型上下文协议端点。开发人员访问的恶意网站可以到达端点并读取项目的磁盘位置、错误报告中的源代码片段、路由清单和开发日志。生产部署不服务于此端点。此问题已在 16.3.8 版本中修复。(CVE-2026-94485)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Next.js は、フルスタックの Web アプリケーションを構築するための React フレームワークです。16.0.0から16.3.8まで、「next dev」開発サーバーは、クロスサイトリクエストを確実に制限することなく、モデルコンテキストプロトコルエンドポイントを公開します。開発者がアクセスした悪意のあるWebサイトは、エンドポイントに到達し、プロジェクトのディスクの場所、エラーレポートからのソースコードスニペット、ルートインベントリ、開発ログを読み取ることができます。実稼働デプロイメントはこのエンドポイントのサービスを提供しません。この問題はバージョン 16.3.8 で修正されています。(CVE-2026-94485)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next     dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site     requests. A malicious website visited by a developer can reach the endpoint and read the project's disk     location, source code snippets from error reports, route inventory, and development logs. Production     deployments do not serve this endpoint. This issue is fixed in version 16.3.8. (CVE-2026-94485)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
115751	Next.js 15.x < 15.5.27 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	11/6/2026	11/6/2026	high
115752	Next.js 16.0.x < 16.3.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	11/6/2026	11/6/2026	high
473992	Echo: next: security update to 16.3.8	Tenable Self-Hosted Container Security	Echo Local Security Checks	10/9/2026	10/13/2026	medium
474016	Chainguard: zitadel-4-login: security update to 4.19.4-r3	Tenable Cloud Security	Chainguard Local Security Checks	10/9/2026	10/9/2026	medium
473761	SCA: security update for next (GHSA-f87g-xv8r-7p7x)	Tenable Cloud Security	SCA Checks	10/8/2026	10/8/2026	medium
474016	Chainguard: zitadel-4-login: security update to 4.19.4-r3	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	10/9/2026	10/9/2026	medium
473761	SCA: security update for next (GHSA-f87g-xv8r-7p7x)	Tenable Self-Hosted Container Security	SCA Checks	10/8/2026	10/8/2026	medium
473992	Echo: next: security update to 16.3.8	Tenable Cloud Security	Echo Local Security Checks	10/9/2026	10/13/2026	medium
362698	Linux Distros 未修補弱點：CVE-2026-94485	Nessus	Misc.	10/2/2026	11/6/2026	medium
362698	Linux Distros 未修补的漏洞：CVE-2026-94485	Nessus	Misc.	10/2/2026	11/6/2026	medium
362698	Linux Distros のパッチ未適用の脆弱性: CVE-2026-94485	Nessus	Misc.	10/2/2026	11/6/2026	medium
362698	Linux Distros Unpatched Vulnerability : CVE-2026-94485	Nessus	Misc.	10/2/2026	11/6/2026	medium

Detections

Analytics

Plugins Search

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium