Next.js 16.0.x < 16.3.8 Multiple Vulnerabilities

high Web App Scanning Plugin ID 115752

Synopsis

Description

The version of Next.js installed on the remote host is 15.0.0 prior to 15.5.27 or 16.0.0 prior to 16.3.8. It is, therefore, affected by multiple vulnerabilities:

- A Server-Side Request Forgery vulnerability in the Image Optimization API, where an attacker-controlled, allow-listed remote URL can lead to requests to private IP addresses. This issue only affects versions 16.0.0 and later. (CVE-2026-94483)

- A cache poisoning vulnerability in self-hosted applications using the Pages Router with SSG or ISR pages, allowing a page's cache entry to be replaced with content from a different route. (CVE-2026-94543)

- A cache poisoning vulnerability in applications using a root-level catch-all page together with SSG or ISR routes, leading to cross-user content substitution and persistent denial of service. (CVE-2026-94484)

- An information disclosure vulnerability in App Router metadata image routes built with webpack, which ignore the 'dynamicParams' route segment option. (CVE-2026-94485)

- An information disclosure vulnerability where pending 'use cache' fills are shared between Draft Mode and regular requests, leaking unpublished content. This issue only affects versions 16.0.0 and later. (CVE-2026-94544)

- A cache leak across root param values in nested 'use cache' functions when Cache Components are enabled. This issue only affects versions 16.0.0 and later. (CVE-2026-103004)

- An information disclosure vulnerability in the development server's Model Context Protocol endpoint, which does not verify the request origin. This issue only affects versions 16.0.0 and later. (CVE-2026-94486)

Note that the scanner has not attempted to exploit these issues but has instead relied only on application's self-reported version number.