EUVD-2026-25928Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth (PR:N, AV:N); partial CIA impact on vulnerable system only, no scope change per 4.0 subsequent-system metrics.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A security flaw has been discovered in ChatGPTNextWeb NextChat up to 2.16.1. Affected by this issue is the function proxyHandler of the file app/api/[provider]/[...path]/route.ts. The manipulation results in server-side request forgery. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in ChatGPTNextWeb NextChat 2.16.0-2.16.1 allows unauthenticated remote attackers to manipulate the proxyHandler function in app/api/[provider]/[...path]/route.ts to coerce the server into issuing arbitrary HTTP requests to attacker-controlled internal or external destinations. A public proof-of-concept exploit is confirmed available, and the vendor has not yet responded to responsible disclosure filed as GitHub issue #6742, leaving no patch available. Despite a low EPSS score of 0.04%, the zero-authentication requirement combined with public exploit code warrants prompt compensating controls for any internet-exposed deployment.
Technical ContextAI
NextChat is an open-source Next.js web application that proxies user requests to multiple AI providers (OpenAI, Anthropic, etc.) via dynamic API routes. The vulnerability resides in the proxyHandler function within app/api/[provider]/[...path]/route.ts, where user-supplied URL components are forwarded to backend services without adequate origin validation or allowlist enforcement. This is a textbook CWE-918 (Server-Side Request Forgery) flaw - the application server becomes an unwitting HTTP relay, potentially exposing cloud metadata endpoints (e.g., 169.254.169.254), internal microservices, or RFC 1918-addressed resources inaccessible from the public internet. The affected CPE is cpe:2.3:a:chatgptnextweb:nextchat:*:*:*:*:*:*:*:*, covering all versions through 2.16.1 per NVD and EUVD-2026-25928.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project maintainers have not responded to the GitHub issue disclosure at https://github.com/ChatGPTNextWeb/NextChat/issues/6742. As an immediate compensating control, deploy egress firewall rules on the NextChat application server to allowlist only required AI provider API endpoints (e.g., api.openai.com, api.anthropic.com) and explicitly block outbound requests to RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and cloud metadata endpoints (169.254.169.254); note this may require maintenance as provider IPs change. If the application can be placed behind an authentication proxy (e.g., OAuth2 middleware or Cloudflare Access), doing so converts PR:N to PR:L and meaningfully raises the exploitation bar, though this may conflict with intended public-access deployments. Monitor VulDB (https://vuldb.com/vuln/359779) and the upstream GitHub repository for a patched release.
Credential exfiltration in NextChat 2.15.8-2.16.1 allows unauthenticated network attackers to steal the server's OpenAI
Server-side request forgery in ChatGPTNextWeb NextChat through version 2.16.1 allows remote unauthenticated attackers to
Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today