ModerateVulnerabilityGHSA-f87g-xv8r-7p7xCVE-2026-94485Published 7 Oct 2026
Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass
Affected releases · next
- 16.x16.0.0 – 16.3.7Fixed in 16.3.8
On 16.x, the newest line:
npm install next@16.3.8Not affected
0.1.0 – 15.5.28
378 releases
Affected
16.0.0 – 16.3.7
41 releases
Fixed
16.3.8 – 16.4.2
4 releases, latest
Is your project affected?
Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.
What happens
In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams().