---
id: CVE-2026-92931
title: >-
  CWE-918: Server-Side Request Forgery in the Progress
  @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through
  15.4.8637 may allow a remote attacker to make server-side requests to an
  attacker-controlled host, potentially ex…
summary: >-
  CWE-918: Server-Side Request Forgery in the Progress
  @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through
  15.4.8637 may allow a remote attacker to make server-side requests to an
  attacker-controlled host, potentially ex…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-918
vendor: Progress Software
product: '@progress/sitefinity-nextjs-sdk'
affected:
  - '@progress/sitefinity-nextjs-sdk >= 15.1.8326 < 15.4.8638'
published: '2026-10-05'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T18:16:58.430'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92931'
references:
  - url: >-
      https://community.progress.com/s/article/Sitefinity-Critical-Security-Advisory-for-Addressing-Security-Vulnerabilities-in-Next-js-September-2026
    label: security@progress.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-06T03:55:57.764065Z'
ingestedAt: '2026-10-05T14:21:05.312Z'
epss: 0.00263
epssPercentile: 0.18021
---

## Overview

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.