A vulnerability in the Next.js development server allows a malicious webpage that a developer visits to send requests to the exposed Model Context Protocol endpoint. Because the endpoint lacks proper cross‑site request restrictions, the attacker can read sensitive data such as the project's disk path, source code snippets from error reports, route inventory, and development logs. The flaw appears to not require authentication (inferred from lack of authentication checks) and is limited to the development environment; production deployments do not expose the endpoint.

Next.js versions from 16.0.0 through 16.3.7 are affected. The issue is present only on the development server, not on production deployments, and is fixed in Next.js 16.3.8.

The CVSS score is 2.3, indicating a low severity impact. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers could likely exploit the lack of same‑origin restrictions by hosting a malicious site and visiting the dev server (inferred), then retrieving source code snippets, file paths, and other internal information. The exposure appears limited to developers who have direct access to the machine running the dev server and to the network that can reach it (inferred).