Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vulnerability affects the function proxyHandler of the file app/api/proxy.ts of the component Proxy Fallback Handler. This manipulation of the argument x-base-url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-105238: NextChat's proxy trusts the x-base-url header, so anyone can make the server send requests. Exploit is public, no fix merged yet. Details: https://vulntracker.io/cves/CVE-2026-105238 #NextChat #SSRF #CVE #InfoSec https://t.co/gWj0xwROv0
🔔 *CVE-2026-105238* A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vulnerability affects the function proxyHandler of the file app/api/proxy.ts of the component Proxy Fallback Handler.
🔐 NextChat SSRF — CVE-2026-105238 CVSS 7.3, Unauthenticated Open Proxy in Proxy Fallback Handler Unauthenticated server-side request forgery vulnerability in ChatGPTNextWeb/NextChat up to version 2.16.1. 🔗 https://threataft.com/articles/nextchat-ssrf-cve-2026-105238?utm_source=twitter&utm_medium=social&utm_campaign=share #CyberSecurity #ThreatIntel #NextChat #CVE