CVE-2026-105238 in NextChat
Summary
by MITRE • 10/05/2026
A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vulnerability affects the function proxyHandler of the file app/api/proxy.ts of the component Proxy Fallback Handler. This manipulation of the argument x-base-url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in ChatGPTNextWeb, also known as NextChat, specifically within versions up to 2.16.1, represents a critical server-side security flaw rooted in the application's proxy handling mechanism. This component is responsible for managing requests that are forwarded through an intermediate layer, often used to bypass client-side restrictions or manage API key routing. The core of the issue lies in the proxyHandler function located within the app/api/proxy.ts file. This handler acts as a gateway for HTTP requests, determining which upstream server should receive the traffic based on configuration parameters provided by the user. In this specific instance, the vulnerability arises from an improper validation and sanitization process applied to the x-base-url header or argument. When a client submits a request containing this parameter, the application fails to adequately restrict the allowed destination domains or protocols, thereby allowing an attacker to dictate where the server sends its requests.
This lack of input validation directly leads to Server-Side Request Forgery, commonly abbreviated as SSRF. In technical terms, SSRF allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of their choosing. Because these requests originate from the backend infrastructure rather than the client's browser, they often bypass network security controls such as firewalls and access control lists that are typically configured to protect internal resources. The vulnerability is classified under CWE-918 in the Common Weakness Enumeration standard, which specifically addresses Server-Side Request Forgery flaws resulting from insufficient validation of user-supplied input used for constructing server-side requests. This classification highlights the fundamental failure in the application's logic to verify that the requested resource resides within an expected and safe boundary.
The operational impact of this vulnerability is significant due to its remote exploitability. An attacker can initiate the attack over a network without requiring prior authentication, depending on whether the proxy endpoint is publicly accessible or if it requires valid API keys for other reasons. If successful, the exploitation could lead to several severe consequences. The most immediate risk involves internal network reconnaissance, where an attacker maps out the internal infrastructure by probing ports and services that are not exposed to the public internet. Furthermore, attackers can leverage this flaw to access sensitive data stored on internal servers, such as metadata endpoints in cloud environments like AWS or Azure, which often contain temporary credentials for other resources. In more complex scenarios, if the backend server has trust relationships with other systems, an attacker might pivot through these trusted connections to compromise additional services within the organization's network perimeter.
The presence of a published exploit indicates that this vulnerability is actively being weaponized by threat actors in the wild. This elevates the urgency for remediation significantly beyond standard patching cycles. Organizations and individuals running instances of NextChat up to version 2.16.1 are at immediate risk unless mitigations are applied manually or until an official fix is released. The fact that a pull request exists but awaits acceptance suggests that while a technical solution has been proposed by the community, it may not yet be integrated into the main codebase or distributed via package managers. This gap between vulnerability discovery and patch availability creates a window of exposure where automated scanners and manual attackers can target unpatched instances with high confidence of success.
To mitigate this risk in the absence of an official update, administrators should implement strict allow-listing for proxy destinations. Instead of relying on the application's default behavior which may accept any URL provided via the x-base-url parameter, operators must configure the server to only permit requests to known and trusted domains. This can be achieved by modifying the configuration files or environment variables associated with NextChat to restrict outbound connections. Additionally, deploying a Web Application Firewall that inspects outgoing traffic from the application server for signs of SSRF attempts can provide an additional layer of defense. It is also advisable to disable public access to any proxy endpoints if they are not strictly necessary for legitimate use cases. Until the official patch is merged and released, continuous monitoring of network logs for unusual outbound connections originating from the NextChat service instance is recommended to detect potential exploitation attempts early.