6 matches found
GHSA-F87G-XV8R-7P7X Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass
In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams...
NPM: Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass
NPM: Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass vulnerability discovered by ? in WordPress Npm next versions = 16.0.0, 16.3.8...
Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass
In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams...
CVE-2026-94485 Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...
CVE-2026-94485 Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...
CVE-2026-94485 Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...