CVE-2026-105238

Name of the Vulnerable Software and Affected Versions ChatGPTNextWeb NextChat versions prior to 2.16.2

Description A flaw in the Proxy Fallback Handler component allows for server-side request forgery, which occurs when an attacker can induce the server to make requests to an unintended location. This issue is located in the proxyHandler() function within the app/api/proxy.ts file and is triggered by manipulating the x-base-url argument. The attack can be initiated remotely.

Recommendations Update ChatGPTNextWeb NextChat to version 2.16.2 or later. As a temporary workaround, restrict or monitor the use of the x-base-url argument in the proxyHandler() function.