All vulnerabilities
CVE-2026-94485GHSA-f87g-xv8r-7p7x

Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

vercel nextnpmFrameworks
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in16.3.8Also 16.3.?GitHub
Published2 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 16.3.8next, npmGitHubnpm install next@16.3.8
  • 16.3.?next, npmGitHubnpm install next@16.3.?

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams().

Text from CVE List

Affected versions 4

  • next, npm>= 16.0.0, < 16.3.8GitHub
  • next.jsaffected: >= 16.0.0, < 16.3.8CVE List
  • next, npm>= 16.0.0GitHub
  • next, npmfrom 16.0.0, fixed in 16.3.8OSV

References 5