GHSA-39w2-rjm5-chcv
Next.js has information disclosure in development server's Model Context Protocol endpoint
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
The Next.js development server (`next dev`) exposes a Model Context Protocol endpoint that does not verify which website a request originates from, allowing a malicious website visited by the developer to read sensitive development data — including the project's location on disk, source code snippets from error reports, the route inventory, and development logs. Only applications run with `next dev` are affected. Production deployments do not serve this endpoint.
References
External links from the advisory. They lead to third-party sites.