CVE-2026-92931: CWE-918: Server-Side Request Forgery in Progress Software @progress/sitefinity-nextjs-sdk

CVE-2026-92931 is a CWE-918 SSRF vulnerability affecting the @progress/sitefinity-nextjs-sdk npm package versions from 15.1.8326 up to but not including 15.4.8638. The flaw permits remote attackers to induce the server to send requests to arbitrary hosts under attacker control, which may lead to unauthorized information disclosure. The vulnerability is rated critical with a CVSS 3.1 base score of 10.0, reflecting network attack vector, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated remote attacker to cause the server to make arbitrary requests to attacker-controlled hosts. This can lead to exposure of sensitive internal information, compromise of system integrity, and potential denial of service. The critical CVSS score reflects the severity of these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There are no provided patch links or official fixes at this time. Users should monitor Progress Software advisories for updates and apply any forthcoming patches promptly.