A website can read project data from the Next.js development server
On September 30, 2026, Next.js listed a low-severity bug in next dev, CVE-2026-94486. From 16.0.0 until 16.3.8, the development server's Model Context Protocol endpoint does not reliably block cross-site requests, so a malicious site open in the developer's browser can read project data. Production does not serve the endpoint. The fix is 16.3.8.
What was reported
The September 30, 2026 Next.js security release rates CVE-2026-94486 / GHSA-39w2-rjm5-chcv as low severity. It says the Next.js development server, next dev, exposes a Model Context Protocol endpoint that does not verify which website a request comes from. A malicious website visited by the developer can read the project's location on disk, source snippets from error reports, the route inventory, and development logs. Only next dev is affected. Production deployments do not serve the endpoint.
CVE-2026-94486, in the record published October 2, 2026, says the affected range is next 16.0.0 until 16.3.8, and that 16.3.8 is the fix. It says the endpoint does not reliably restrict cross-site requests, and repeats that production deployments do not serve it.
This is the development server a local Next.js app runs while you build. It is not a production outage, and the vendor's severity for it is low.
How to prevent it
Upgrade next to 16.3.8 or later if you run next dev on 16.0.0 before 16.3.8. The CVE record says production deployments do not serve this endpoint, so a deployed app is not the thing to patch for this bug. The development server is.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.