CVE-2026-94485

npm/next CVE-2026-94485: medium 5.3, EPSS 0.17%

Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

Action: Upgrade next to 16.3.8 or later.

npm i next@16.3.8

Affected

Fixed versions

Sources

• osv: GHSA-f87g-xv8r-7p7x
• https://github.com/vercel/next.js/security/advisories/GHSA-f87g-xv8r-7p7x
• https://nvd.nist.gov/vuln/detail/CVE-2026-94485
• https://github.com/vercel/next.js/commit/2d9f50a409312696145b82b3157aadb6b1fef476
• https://github.com/vercel/next.js
• https://github.com/vercel/next.js/releases/tag/v16.3.8

CVE-2026-94485 · published 2026-10-07T20:31:33Z · modified 2026-10-07T20:45:04.338515172Z · JSON