CVE-2026-94485

Executive Summary

CVE-2026-94485 is a cross-origin access control weakness (CWE-346) affecting the next dev development server in Next.js versions 16.0.0 through 16.3.7. The development server exposes a Model Context Protocol (MCP) endpoint that does not reliably restrict cross-site requests, allowing a malicious website visited by a developer to reach the endpoint and read sensitive project information including the disk location, source code snippets from error reports, route inventory, and development logs. Production deployments are not affected because they do not serve this endpoint; the issue is fixed in Next.js 16.3.8.

Technical Analysis

The vulnerability resides in the development-only HTTP server started by next dev. According to the NVD description, this server exposes a Model Context Protocol (MCP) endpoint. MCP is a protocol used to expose tools, resources, and context data to AI/developer tooling. Because the endpoint does not reliably enforce restrictions on cross-site requests, a web browser can be induced — via a page on an attacker-controlled origin — to issue requests to the locally bound development server on the developer's machine.

The root cause maps to CWE-346 (Origin Validation Error): the server fails to properly validate the Origin header (or equivalent cross-origin request controls such as an authentication token or CSRF protection) before returning data to the caller. Without a correct origin check, standard browser cross-origin request behavior does not prevent the endpoint from responding with data to an unauthorized origin. This is a classic "localhost service reachable from the browser" problem — the attacker does not need network access to the developer's machine, only that the developer visit a malicious web page while the development server is running.

The confidentiality impact is driven by what the exposed endpoint returns (per the NVD description):

• The project's disk location (filesystem path).
• Source code snippets returned within error reports.
• Route inventory (the set of application routes).
• Development logs.

The description does not identify specific endpoint paths, parameter names, function names, or header names; those implementation details are not disclosed. Analysis should therefore remain at the vulnerability-class level: insufficient origin validation on a locally exposed development HTTP endpoint.

Notably, production deployments do not serve this endpoint, which meaningfully constrains the blast radius to development environments only. The attack requires user interaction (developer visits a malicious site) and no authentication on the attacker's part.

Exploitation Scenarios

No public PoC or exploit code is available. The attack chain below is inferred strictly from the NVD description and the CWE-346 vulnerability class; no specific request paths or parameter names are asserted because none are provided in the source data.

1. Reconnaissance / target identification: The attacker identifies developers who are likely running the next dev development server locally (a default and ubiquitous workflow). The attacker does not need to scan the developer's host directly; the target is reached through the victim's own browser.

2. Triggering the flaw class: The attacker hosts (or compromises) a website and induces the developer to visit it (phishing, malvertising, a malicious dependency's documentation link, or a shared dev-community link). The page contains script that issues cross-origin requests to the Model Context Protocol endpoint exposed by the locally running next dev server. Because the endpoint "does not reliably restrict cross-site requests," the browser's cross-origin protections do not stop the endpoint from returning data to the attacker-controlled origin.

3. Execution method at the vulnerability-class level: The attacker's JavaScript causes the victim's browser to query the MCP endpoint. Due to the missing/incorrect origin validation (CWE-346), responses containing sensitive development context are returned and can be exfiltrated to the attacker's server.

4. Post-exploitation impact: The attacker obtains the project's disk location, source code snippets drawn from error reports, the route inventory, and development logs. This information supports follow-on attacks: source disclosure can reveal secrets embedded in code or error output, route inventory maps the application's attack surface, path disclosure aids further filesystem-oriented attacks, and logs may contain tokens, credentials, or internal URLs. The description does not indicate that the endpoint allows arbitrary code execution or file writes; the impact described is confidentiality-focused.

Important constraint: this attack works only while the developer is running next dev; production deployments do not expose the endpoint and are unaffected.

Impact Assessment

The CVSS vector provided (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N, presented here as an analytic characterization since no score was assigned by the source data) reflects: network accessibility (AV:N) from the victim's browser, low attack complexity (AC:L), no privileges required (PR:N), and user interaction required (UI:R) because the developer must visit a malicious page. Scope is changed (S:C) because the vulnerable component (the local dev server) is impacted in a way that crosses a trust boundary from the attacker's web origin. Confidentiality impact is High (C:H) given source code snippets, project paths, routes, and logs are exposed; integrity (I:N) and availability (A:N) impacts are not described.

Business impact:

• Source code and error-report snippet disclosure can leak proprietary logic and, in many real-world cases, hardcoded secrets or tokens surfaced in errors.
• Route inventory and development logs expand an attacker's knowledge base for subsequent, more targeted intrusions.
• Exposure is limited to development machines — high-value targets because they frequently hold credentials, environment files, and access to internal services.
• Blast radius is constrained: production deployments do not serve the endpoint. Organizations remain exposed only while developers run next dev on an affected version.

Because no EPSS score exists and the CVE is not in CISA KEV, there is no evidence of mass exploitation. No threat actor campaign is described in the source data.

Detection Guidance

Sigma Rule

title: Cross-Origin Request to Next.js Dev Server MCP Endpoint
id: 3f9c1a2e-8b74-4d3a-9c1e-202694485a01
status: experimental
description: Detects HTTP requests with an external Origin reaching a locally bound Next.js development server MCP endpoint (CVE-2026-94485).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94485
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.346
logsource:
  category: webserver
  product: nextjs
detection:
  selection_local:
    dst_ip|cidr:
      - '127.0.0.0/8'
      - '::1/128'
  selection_origin:
    cs-header|contains: 'Origin:'
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  filter_sameorigin:
    cs-header|contains:
      - 'Origin: http://localhost'
      - 'Origin: http://127.0.0.1'
      - 'Origin: http://[::1]'
  condition: selection_local and selection_origin and selection_method and not filter_sameorigin
falsepositives:
  - Legitimate cross-origin developer tooling explicitly permitted by the developer
level: medium

YARA Rule

rule CVE_2026_94485_Nextjs_Dev_MCP_CrossOrigin_Reporter
{
    meta:
        description = "Detects client-side scripts or artifacts attempting to reach a local Next.js dev MCP endpoint (CVE-2026-94485)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94485"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $mcp = "mcp" ascii nocase
        $localhost = "localhost" ascii nocase
        $l127 = "127.0.0.1" ascii
        $l16 = ":3000" ascii
        $fetch = "fetch(" ascii
        $xhr = "XMLHttpRequest" ascii
        $origin = "Origin" ascii
    condition:
        uint32(0) != 0x504b0304 and
        ($mcp and ($localhost or $l127 or $l16)) and
        ($fetch or $xhr)
}

Suricata IDS Rule

alert http $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-94485 Possible Next.js Dev Server MCP Endpoint Cross-Origin Access Attempt"; flow:to_server,established; http.method; content:"GET"; http.header; content:"Origin:"; nocase; http.header; content:"localhost"; nocase; http.uri; content:"mcp"; nocase; reference:cve,2026-94485; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94485; classtype:attempted-recon; sid:9448526; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where network.direction == "inbound"
      and destination.port in (3000, 3001, 8080)
      and http.request.method in ("GET", "POST")
      and http.request.headers.Origin != null
      and not http.request.headers.Origin : ("*localhost*", "*127.0.0.1*", "*[::1]*") ]
  [ network where network.direction == "outbound"
      and http.response.status_code == 200 ]

Splunk SPL Query

index=web OR index=proxy
| eval is_local=if(match(dest_ip,"^(127\.|::1)") OR match(host,"localhost"),1,0)
| eval has_ext_origin=if(isnotnull(origin_header) AND NOT match(origin_header,"localhost|127\.0\.0\.1|\[::1\]"),1,0)
| where is_local=1 AND has_ext_origin=1
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, uri_path, origin_header, http_method
| where count > 0
| sort - count
| table first_seen last_seen src_ip dest_ip http_method uri_path origin_header count

Wazuh OSSEC Rule

<group name="nextjs,web,">
  <rule id="944852" level="10">
    <decoded_as>json</decoded_as>
    <field name="origin">\.</field>
    <field name="url">mcp</field>
    <field name="dest_ip">127\.0\.0\.1|::1|localhost</field>
    <description>CVE-2026-94485: Cross-origin request to local Next.js dev MCP endpoint detected.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_94485,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Upgrade to Next.js 16.3.8, the version identified in the NVD description as containing the fix for versions 16.0.0 through 16.3.7.
• If upgrade is not immediately possible, stop running next dev when not actively developing, or bind the development server to a non-default host and avoid accessing untrusted websites while the dev server is running.
• Restrict browsing activity on developer workstations while the development server is active; treat the dev server as a sensitive local service.

2. Patch / upgrade steps:

• Identify all projects with Next.js pinned in the range 16.0.0–16.3.7 (check package.json, lockfiles, and CI images).
• Upgrade next to 16.3.8 and regenerate lockfiles.
• Rebuild and redeploy affected projects. Verify the resolved next version post-install.

3. Long-term hardening:

• Keep development servers on loopback only and avoid exposing them on LAN interfaces.
• Adopt dependency monitoring that flags pre-release/patch gaps for framework dev-server components.
• Enforce origin validation and authentication for any local HTTP service exposed to browser environments (defense at the framework level for CWE-346).
• Reduce secret sprawl in source and error output so that source/error disclosure does not directly yield credentials.

References

• NVD — CVE-2026-94485: https://nvd.nist.gov/vuln/detail/CVE-2026-94485
• Next.js official release/security notes: https://nextjs.org/blog (verify the 16.3.8 security release entry)
• Next.js GitHub repository (security advisories): https://github.com/vercel/next.js/security/advisories
• CWE-346 — Origin Validation Error: https://cwe.mitre.org/data/definitions/346.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-94485 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns and no exploit-in-the-wild evidence are reported for this CVE in the provided data. No public PoC, exploit code, or Nuclei template is available.