CVE-2026-94485: vercel next.js

csirt@kutim:~/threat-intel/cve/CVE-2026-94485

CVSS 5.3 · Medium EPSS 0,15%

Kerentanan Origin Validation Error pada vercel next.js. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.

Rincian

Terbit di NVD: 2 Oktober 2026
Terakhir diubah: 5 Oktober 2026
Status NVD: Analyzed
CVSS 3.1: 5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-346: Origin Validation Error
EPSS (30 hari): 0,15% peluang dieksploitasi; lebih tinggi dari 3,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
vercel	next.js	Versi 16.0.0 hingga sebelum 16.3.8

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/vercel/next.js/security/advisories/GHSA-f87g-xv8r-7p7x advisory vendor
https://github.com/vercel/next.js/commit/2d9f50a409312696145b82b3157aadb6b1fef476 patch
https://github.com/vercel/next.js/releases/tag/v16.3.8 release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 6 Okt 2026, 06:25 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.