Next.js dev server leaks source code through open MCP endpoint

Vercel's Next.js framework exposes sensitive development data through an unprotected Model Context Protocol endpoint in its development server, according to a GitHub security advisory published on 7 October 2026. The flaw is tracked as CVE-2026-94486 under the advisory identifier GHSA-39w2-rjm5-chcv, and affects the npm package next. Only applications started with next dev are affected. The advisory states that production deployments do not serve the endpoint.

Model Context Protocol, or MCP, is the interface that lets AI coding assistants query a tool for context about a project. In Next.js, the development server runs an MCP endpoint locally so that assistants can pull information about the application a developer is building.

The problem is that the endpoint does not check which website a request came from. According to the advisory, that missing origin verification means a malicious website visited by the developer can send requests to the local development server and read back what it returns. The browser supplies the network access; the developer only has to have a tab open while next dev is running.

The advisory lists four categories of data that can be read this way. The first is the project's location on disk, which reveals directory structure and often the developer's username. The second is source code snippets drawn from error reports. The third is the route inventory, meaning the list of paths the application serves, including any that are not meant to be publicly discoverable. The fourth is development logs.

This is a cross-site request forgery pattern, where one site causes a victim's browser to make requests to another service that trusts the browser rather than the caller. It is a long-standing class of web flaw, but the target here is new: a local AI tooling endpoint that was not designed with hostile callers in mind. Local MCP servers are often built on the assumption that anything able to reach localhost is already trusted. A browser running attacker-supplied JavaScript breaks that assumption.

The practical blast radius depends on what a given developer's machine is running. The advisory describes information disclosure only, not code execution or write access to the project. Disclosed source snippets and route lists are nonetheless useful to an attacker preparing a more targeted effort against the same application once it reaches production, though the advisory itself does not make claims about downstream consequences.

The root cause is recorded as a misconfiguration rather than a memory-safety or logic bug, which is consistent with the description: the endpoint works as built, but is reachable by parties it should not serve. Fixing that class of issue usually involves checking the Origin header on incoming requests, binding the listener so it is not reachable from browser contexts, or requiring a token the calling site cannot guess.

Developers running Next.js locally should check the advisory for the affected version ranges and patched releases before continuing. The advisory does not describe any observed exploitation. As a short-term measure, shutting down next dev when it is not in use removes the exposure entirely, since the endpoint only exists while the development server is running.

The advisory names Vercel's Next.js as the affected product and lists the status of the issue as confirmed.