NextChat in ChatGPTNextWeb, up to version 2.16.1, contains a flaw in the proxyHandler function located in app/api/[provider]/[...path]/route.ts. The vulnerability allows an attacker to manipulate the function so that the server performs HTTP requests to arbitrary destinations. This remote exploitation grants the attacker the ability to reach internal network resources, exfiltrate data, or use the server as a proxy to attack other systems. The weakness is identified as CWE‑918 and results in a moderate CVSS score of 6.9.

The affected product is ChatGPTNextWeb’s NextChat application, specifically releases up to and including 2.16.1. No other versions are confirmed, and the project has released the source on GitHub at https://github.com/ChatGPTNextWeb/NextChat; the source files indicate the vulnerability is tied to the proxyHandler route. Organizations running this application should verify that their deployed version is not 2.16.1 or older, or that they have applied a patch that removes the insecure handler.

The exploit is available publicly and can be performed from a remote location. Although the EPSS score is not provided, the CVSS score reflects a moderate risk. The vulnerability is not listed in the CISA KEV catalog, indicating it has not yet been catalogued as a widely known exploit at the time of this assessment. Attackers can target exposed NextChat endpoints to force outbound requests, potentially accessing internal or public resources. No specific authentication or privilege requirements are mentioned, implying that unauthenticated remote access to the affected route would be sufficient. The best‑effort mitigation involves applying the latest version that removes the vulnerable code or otherwise restricting outbound connectivity from the application.