Next.js EUVD-2026-91667

Exploitation requires that the victim be actively running the Next.js next dev development server on an affected version (16.0.0 through 16.3.7) AND that the developer visit an attacker-controlled website in a browser during that session. The malicious site must reach the development MCP endpoint (/_next/mcp), which performs unreliable cross-site origin validation (CWE-346). Strong limiting factors: production/built deployments never serve this endpoint, so only developer machines during active local development are exposed; the attack depends on victim-side browsing (UI:P) to a malicious page; and impact is read-only disclosure of development metadata (disk path, error-report source snippets, route inventory, dev logs) rather than code execution or data modification.

This is a genuinely low-priority issue that the signals agree on, not a high-CVSS-but-low-risk mismatch. The vendor-assigned CVSS 4.0 base score is 2.3 (Low), and the vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N) is internally consistent with the description: network-reachable but gated by an attack requirement (AT:P - the victim must be actively running the next dev server) and passive user interaction (UI:P - the developer must visit a malicious website). Impact is confined to low-grade information disclosure. No EPSS score was supplied, and there is no CISA KEV listing and no public proof-of-concept in the provided data, so exploitation status is: no public exploit identified at time of analysis. The most important risk-limiting fact - confirmed by the description and corroborated by the patch commit touching dev-only MCP and cross-site-dev middleware - is that production deployments do not serve the vulnerable endpoint, so blast radius is limited to developer workstations during active local development. No key signals are conflicting; the only gap is the absence of EPSS/exploit telemetry, which for a dev-server-only Low-severity issue does not materially change prioritization. Treat as routine patch-management, not an emergency.

A developer is running the Next.js next dev server locally (versions 16.0.0-16.3.7) and, in the same browser session, visits an attacker-controlled web page. Because the development Model Context Protocol endpoint does not reliably block cross-site requests, the malicious page issues requests to the local dev server and exfiltrates the project's on-disk path, source-code snippets surfaced in error reports, the route inventory, and development logs. No public exploit code is identified at time of analysis, and the attack cannot reach production deployments.