CVE-2026-92931

CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK

State: Published
Severity: 8.8 High
Published: Oct 5, 2026
Updated: Oct 6, 2026
Reserved: Sep 17, 2026

Description

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	ProgressSoftware

Weaknesses

CWE-918 Server-Side Request Forgery

Affected Products

Product	Versions
@progress/sitefinity-nextjs-sdkProgress Software	15.1.8326 to before 15.4.8638Affected

References

https://community.progress.com/s/article/Sitefinity-Critical-Security-Advisory-for-Addressing-Security-Vulnerabilities-in-Next-js-September-2026vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.