CVE-2026-94486

Executive Summary

CVE-2026-94486 is a cross-origin access control vulnerability (CWE-346) in the Next.js development server. From version 16.0.0 until 16.3.8, the next dev server exposes a Model Context Protocol (MCP) endpoint without reliably restricting cross-site requests. A developer visiting a malicious website while the development server is running can have that endpoint reached by attacker-controlled JavaScript, resulting in unauthorized disclosure of local project information. Production deployments are not affected because they do not serve this endpoint.

Technical Analysis

Next.js is a React framework for building full-stack web applications. The vulnerability resides in the development-only HTTP server initiated by the next dev command. Starting with version 16.0.0, that development server exposes a Model Context Protocol endpoint. Model Context Protocol (MCP) is an interface used to expose contextual capabilities — in this case project-related information — to tooling.

The core defect is a failure to reliably enforce cross-origin restrictions on requests to this endpoint (CWE-346: Origin Validation Error). A browser-based cross-site request generated by JavaScript running on an attacker-controlled origin is not consistently blocked. Where the browser does not enforce a strict same-origin policy for the request pattern involved, the malicious page can cause the developer's browser to transmit a request to the loopback-reachable development server and read the response.

The information exposed to a successful cross-origin read includes, per the NVD description:

• The project's disk location
• Source code snippets surfaced in error reports
• The route inventory
• Development logs

This is an information disclosure class vulnerability. The NVD description does not disclose the endpoint's exact URL path, the MCP method or tool names invoked, the specific origin-validation logic that failed, or the precise response schema. No public proof-of-concept, exploit code, or Nuclei template is available. The attack chain below is therefore described at the vulnerability-class level only, using only mechanism details present in the authoritative description.

The relevant scope caveat is significant: production deployments do not serve this endpoint. Only running next dev sessions are exposed, and the endpoint is reachable from the developer's browser context.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the vendor-supplied description. The following steps rely exclusively on details stated in the NVD description.

1. Reconnaissance and target identification. The attacker identifies or assumes a target set of developers running the Next.js development server (next dev) on versions 16.0.0 through 16.3.7. Because the endpoint exists only in the development server and is commonly bound to a local or developer-reachable address, the attack is delivered opportunistically: the attacker hosts a website likely to be visited by the target developer.

2. Triggering the flaw class. The vulnerability class is a cross-origin (origin validation) failure. A developer, while a next dev process is running, visits the attacker-controlled malicious website. JavaScript on that page issues a cross-site request to the locally reachable development server's MCP endpoint. The unreliable cross-site restriction means the request is not dependably blocked, so the endpoint processes it as if it were a legitimate same-origin/tooling request.

3. Payload/execution method. The payload executes in the victim's browser as ordinary JavaScript served by the malicious site. No notification is given to the developer. Because the flaw is an access-control defect (CWE-346) rather than an injection or code-execution flaw, the "payload" is simply the cross-site request plus logic to capture and exfiltrate the endpoint's response. The response content is read in the browser and can be transmitted back to the attacker.

4. Post-exploitation impact. On success, the attacker obtains the project's disk location, source code snippets from error reports, the route inventory, and development logs. These artifacts support follow-on activity such as mapping the application's structure, harvesting source fragments and secrets that may appear in error output or logs, and fingerprinting the target's environment for later intrusion. The CVSS vector indicates network attack vector, no privileges, required user interaction (the visit), changed scope, and high confidentiality impact — but no integrity or availability impact.

Note on excluded details: the NVD description does not name the endpoint path, parameter names, or MCP tool identifiers. Those should not be assumed. Operators should treat any cross-origin read against the development server's MCP surface as anomalous regardless of the specific request shape.

Impact Assessment

Affected systems are developer workstations and development environments running the Next.js next dev server on versions 16.0.0 through 16.3.7. Production deployments are explicitly not affected, which substantially limits blast radius to the development tier.

Business impact centers on confidentiality rather than code execution. Exposed data — project disk location, source code snippets in error reports, route inventory, and development logs — can reveal application internals, internal path structures, and potentially sensitive content that flows into error output or logs. Because this is a developer-machine exposure, the blast radius depends on what those developers have locally: source checkouts, credentials or configuration referenced in logs or error snippets, and internal route maps useful for subsequent targeted exploitation.

A CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N is provided (no numeric score present in source data). It reflects low attack complexity, no required privileges, required user interaction (the malicious-site visit), changed scope, high confidentiality impact, and no integrity or availability impact. No EPSS score has been assigned by FIRST.org. CISA KEV status: NO — no known exploitation in the wild at time of authorship. No public PoC, exploit code, or Nuclei template exists.

Detection Guidance

Sigma Rule

title: Next.js Dev Server MCP Endpoint Cross-Origin Access Attempt
id: 8b1c4f2e-9448-6cve-2026-94486
status: experimental
description: Detects cross-origin HTTP access to the Next.js development server Model Context Protocol (MCP) endpoint (CVE-2026-94486). Dev servers on Next.js 16.0.0-16.3.7 do not reliably restrict cross-site requests.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94486
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: nextjs
detection:
  selection_dev_server:
    cs-method: 'GET'
    cs-uri-stem|contains: 'mcp'
  selection_cross_origin:
    cs-host|contains:
      - 'localhost'
      - '127.0.0.1'
  filter_legit_origin:
    cs-referer|startswith:
      - 'http://localhost'
      - 'http://127.0.0.1'
  condition: selection_dev_server and selection_cross_origin and not filter_legit_origin
falsepositives:
  - Legitimate development tooling that does not set a Referer header
level: medium
tags:
  - attack.t1189
  - cve.2026.94486

YARA Rule

rule CVE_2026_94486_NextJS_MCP_CrossOrigin
{
    meta:
        description = "Detects artifacts referencing the Next.js dev server MCP cross-origin exposure (CVE-2026-94486)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94486"
        date = "2026-01-01"
        severity = "medium"
        cve = "CVE-2026-94486"

    strings:
        $mcp = "Model Context Protocol" ascii wide nocase
        $nextdev = "next dev" ascii wide nocase
        $fetch = "fetch(" ascii
        $xorigin = "cross-origin" ascii wide nocase
        $loopback = "127.0.0.1" ascii wide
        $lhost = "localhost" ascii wide

    condition:
        (uint32(0) == 0x464C457F or uint32(0) == 0x50450000 or uint32(0) == 0x213C6173) and
        filesize < 10MB and
        (
            ($mcp and $nextdev) or
            ($fetch and $loopback and $xorigin)
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-94486 Next.js Dev Server MCP Endpoint Cross-Origin Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.host; content:"localhost"; http.uri; content:"mcp"; nocase; http.header; content:"Referer"; negate; pcre:"/Referer:\s*https?:\/\/(?!localhost|127\.0\.0\.1)/Hi"; reference:cve,2026-94486; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94486; classtype:attempted-recon; sid:202694486; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, confidence Medium;)

Elastic Detection

network where
  http.request.method == "GET" and
  stringContains(http.request.uri, "mcp", false) and
  (
    stringContains(http.request.headers.host, "localhost") or
    stringContains(http.request.headers.host, "127.0.0.1")
  ) and
  http.request.headers.referer != null and
  not stringStartsWith(http.request.headers.referer, "http://localhost") and
  not stringStartsWith(http.request.headers.referer, "http://127.0.0.1")

Splunk SPL Query

index=web OR index=proxy
| search (uri_path="*mcp*" OR url="*mcp*") (host="localhost*" OR host="127.0.0.1*" OR dest="127.0.0.1")
| eval origin=coalesce(http_referer, referer, cs_Referer)
| where isnull(origin) OR NOT (match(origin, "^https?://(localhost|127\.0\.0\.1)"))
| stats count min(_time) as first_seen max(_time) as last_seen values(origin) as origins values(src_ip) as sources by host, uri_path
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,nextjs,cve-2026-94486,">
  <rule id="202694486" level="8">
    <decoded_as>json</decoded_as>
    <field name="uri">\.*mcp\.*</field>
    <field name="host">localhost|127.0.0.1</field>
    <description>CVE-2026-94486: Possible cross-origin access to Next.js dev server MCP endpoint</description>
    <mitre>
      <id>T1189</id>
    </mitre>
    <group>attempted_recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list is present in the tracked data. The NVD description states the issue is fixed in version 16.3.8; this should be validated against the vendor's own advisory before relying on it, since no patch source independently confirms it.

1. Immediate mitigations

   • Upgrade Next.js beyond the vulnerable range if possible, targeting 16.3.8 or later per the NVD description; treat this as the primary remediation.
   • Do not run next dev on versions 16.0.0–16.3.7 while browsing untrusted websites. Stopping the development server when not actively developing removes the exposed endpoint entirely.
   • Restrict the development server to loopback only and avoid binding it to 0.0.0.0 or other network-reachable interfaces.
   • Where feasible, block cross-site requests to the local development port at the browser or host-firewall layer, and isolate development browsing from the environment running the dev server (separate browser profile or separate host/browser isolation).
   • Ensure the Next.js development server's MCP endpoint is never exposed beyond the developer machine.

2. Patch/upgrade steps

   • Inventory all developer workstations and CI/dev environments for next versions 16.0.0 through 16.3.7.
   • Upgrade to version 16.3.8 or later as stated in the NVD description, then regenerate lockfiles and rebuild.
   • Confirm after upgrade that the dev server's cross-site behavior against the MCP endpoint is corrected.
   • Because no patch source is currently tracked (0/4 confidence), cross-check the vendor's release notes for 16.3.8 before treating the fix as definitive.

3. Long-term hardening

   • Enforce strict Origin/Referer validation on all development-only endpoints, and require authentication or a per-session token for local tooling endpoints.
   • Adopt a policy that development servers bind to loopback and are never exposed to untrusted network segments.
   • Add automated dependency scanning to flag Next.js versions in the vulnerable range in developer tooling and CI pipelines.
   • Monitor for cross-origin request patterns against local development services as a standing detection use case.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-94486
• CWE-346: Origin Validation Error — https://cwe.mitre.org/data/definitions/346.html
• MITRE ATT&CK T1189: Drive-by Compromise — https://attack.mitre.org/techniques/T1189/
• Next.js (React framework) — vendor project documentation and release notes for version 16.3.8
• CISA KEV Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (status: not listed)

No known threat actor campaign or exploit-in-the-wild evidence is associated with CVE-2026-94486 at time of authorship; CISA KEV status is NO, no public PoC is available, and no EPSS score has been assigned by FIRST.org.