Next.js EUVD-2026-91673

Requires the victim to be actively running the next dev development server of Next.js 16.0.0 through 16.3.7, AND to visit an attacker-controlled (or compromised) website in a browser that can reach the local dev server, which exposes the Model Context Protocol endpoint at /_next/mcp without reliably restricting cross-site requests (CWE-346). Limiting factors that reduce real-world risk: the endpoint is served ONLY in development mode - 'Production deployments do not serve this endpoint' - so production systems are unaffected; exploitation needs an active dev session plus the developer navigating to malicious content (the AT:P / user-navigation prerequisite); and impact is confined to information disclosure (disk location, source snippets, route inventory, dev logs) with no code execution, write, or availability impact.

The vendor-assigned CVSS 4.0 score is 6.3 (Medium), with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - network-reachable, no privileges, but with a Present attack requirement (AT:P) reflecting that exploitation depends on conditions outside the attacker's control (a developer actively running next dev and visiting a malicious site). Impact is limited to low confidentiality (VC:L) with no integrity or availability effect, consistent with CWE-346 (Origin Validation Error) and the information-disclosure nature of the flaw. No EPSS score, CISA KEV listing, or POC was provided in the input: exploitation status is therefore 'no public exploit identified at time of analysis', and there is no evidence of active exploitation. The practical risk is tempered because the MCP endpoint is only served by the development server and 'Production deployments do not serve this endpoint' - so internet-facing production systems are not exposed; the realistic threat surface is developer workstations. This is a genuine but bounded developer-security concern rather than a mass-exploitable critical issue: it should be patched promptly on development machines but does not carry the same urgency as a remotely exploitable production RCE. Note that EPSS/KEV/POC signals are absent (not confirmed negative), so widespread-exploitation probability cannot be quantified from the data given.

A developer is running a Next.js app locally with next dev (version 16.0.0-16.3.7) and, in the same browser, visits a malicious or compromised website. That site issues cross-site requests to the local dev server's /_next/mcp Model Context Protocol endpoint, which fails to reliably validate request origin, and reads back the project's disk path, source-code snippets from error reports, the route inventory, and development logs. No public exploit code is identified at the time of analysis, and exploitation requires the developer to be running the dev server and to visit attacker-controlled content.