{"id":"CVE-2026-94486","aliases":["CLSA-2026-1791978826","CLSA-2026-1792195752","CLSA-2026-1792196732","CLSA-2026-1792206293","CLSA-2026-1792256970","CLSA-2026-1792272234","CLSA-2026-1792293005","CLSA-2026-1792304725","CLSA-2026-1792326298","CLSA-2026-1792338248","CLSA-2026-1792346474","CLSA-2026-1792358591","CLSA-2026-1792363991","CLSA-2026-1792367398","EUVD-2026-91667","GHSA-39w2-rjm5-chcv","ROOT-APP-NPM-CVE-2026-94486"],"status":"published","title":"Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint","description":"Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.","severity":{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00114,"percentile":0.01461,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-346"],"published":"2026-10-02T15:12:31Z","modified":"2026-10-30T19:46:05Z","fixes":[{"ecosystem":"npm","package":"next","fixed_in":["16.3.8"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"next","fixed_in":["16.3.8-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/next","fixed_in":["16.3.8-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"fixed":"16.3.8"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.1","16.0.6-tuxcare.10","16.0.6-tuxcare.11","16.0.6-tuxcare.12","16.0.6-tuxcare.2","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-next-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"next-rspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/third-parties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/codemod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/mdx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.12","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.13"}]}],"versions":["16.0.6","16.0.6-tuxcare.10","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"16.3.8"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.3.8-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.3.8-root.io.1"}]}]}],"products":[{"vendor":"vercel","product":"next.js"}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-39w2-rjm5-chcv","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/vercel/next.js/commit/2d9f50a409312696145b82b3157aadb6b1fef476","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/vercel/next.js/releases/tag/v16.3.8","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94486","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-39w2-rjm5-chcv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94486.json","tags":["advisory"]},{"url":"https://github.com/vercel/next.js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-94486","title":"Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint","description":"Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.","status":"published","published":"2026-10-02T15:12:31.134Z","modified":"2026-10-02T16:20:19.256Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:19:53.786088Z"}],"euvd":[{"id":"EUVD-2026-91667","description":"Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.","status":"published","published":"2026-10-02T15:12:31Z","modified":"2026-10-02T16:20:19Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T17:27:42.693498Z"}],"ghsa":[{"id":"GHSA-39w2-rjm5-chcv","title":"Next.js has information disclosure in development server's Model Context Protocol endpoint","description":"The Next.js development server (`next dev`) exposes a Model Context Protocol endpoint that does not verify which website a request originates from, allowing a malicious website visited by the developer to read sensitive development data — including the project's location on disk, source code snippets from error reports, the route inventory, and development logs. Only applications run with `next dev` are affected. Production deployments do not serve this endpoint.","status":"published","published":"2026-10-07T20:31:51Z","modified":"2026-10-07T20:31:52Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:41:29.107536Z"}],"nvd":[{"id":"CVE-2026-94486","description":"Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.","status":"published","published":"2026-10-02T16:16:51.933Z","modified":"2026-10-05T14:58:14.647Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:12:53.75133Z"}],"osv":[{"id":"CVE-2026-94486","title":"Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint","description":"Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.","status":"published","published":"2026-10-02T15:12:31.134Z","modified":"2026-10-28T03:01:42.96498001Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T15:45:20.931171Z"},{"id":"GHSA-39w2-rjm5-chcv","title":"Next.js has information disclosure in development server's Model Context Protocol endpoint","description":"The Next.js development server (`next dev`) exposes a Model Context Protocol endpoint that does not verify which website a request originates from, allowing a malicious website visited by the developer to read sensitive development data — including the project's location on disk, source code snippets from error reports, the route inventory, and development logs. Only applications run with `next dev` are affected. Production deployments do not serve this endpoint.","status":"published","published":"2026-10-07T20:31:51Z","modified":"2026-10-07T20:45:05.342044468Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"CLSA-2026-1791978826","title":"TuxCare security update for next (5 CVEs)","description":"TuxCare rebuilt next to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-14T11:53:46Z","modified":"2026-10-30T19:46:05.08088577Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792195752","title":"TuxCare security update for create-next-app (5 CVEs)","description":"TuxCare rebuilt create-next-app to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-17T00:09:08Z","modified":"2026-10-17T01:30:09.592153925Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792196732","title":"TuxCare security update for @next/eslint-plugin-next (5 CVEs)","description":"TuxCare rebuilt @next/eslint-plugin-next to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-17T00:25:28Z","modified":"2026-10-17T01:30:12.30896296Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792206293","title":"TuxCare security update for @next/bundle-analyzer (5 CVEs)","description":"TuxCare rebuilt @next/bundle-analyzer to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-17T03:04:49Z","modified":"2026-10-17T07:00:41.241278243Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792256970","title":"TuxCare security update for next-rspack (5 CVEs)","description":"TuxCare rebuilt next-rspack to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-17T17:09:29Z","modified":"2026-10-17T19:01:44.970221293Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792272234","title":"TuxCare security update for @next/plugin-storybook (5 CVEs)","description":"TuxCare rebuilt @next/plugin-storybook to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-17T21:23:50Z","modified":"2026-10-18T01:30:33.787096023Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792293005","title":"TuxCare security update for @next/polyfill-module (5 CVEs)","description":"TuxCare rebuilt @next/polyfill-module to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-18T03:10:01Z","modified":"2026-10-18T07:15:09.799897994Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792304725","title":"TuxCare security update for @next/polyfill-nomodule (5 CVEs)","description":"TuxCare rebuilt @next/polyfill-nomodule to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-18T06:25:21Z","modified":"2026-10-18T07:15:16.00782956Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792326298","title":"TuxCare security update for @next/react-refresh-utils (5 CVEs)","description":"TuxCare rebuilt @next/react-refresh-utils to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-18T12:24:54Z","modified":"2026-10-18T13:15:59.504727516Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792338248","title":"TuxCare security update for @next/third-parties (5 CVEs)","description":"TuxCare rebuilt @next/third-parties to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-18T15:44:06Z","modified":"2026-10-18T19:15:42.060989069Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792346474","title":"TuxCare security update for @next/swc-linux-x64-gnu (5 CVEs)","description":"TuxCare rebuilt @next/swc-linux-x64-gnu to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-18T18:01:10Z","modified":"2026-10-18T19:16:07.804676711Z","updated_at":"2026-11-02T15:43:52.782414Z"},{"id":"CLSA-2026-1792358591","title":"TuxCare security update for @next/codemod (5 CVEs)","description":"TuxCare rebuilt @next/codemod to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-18T21:23:07Z","modified":"2026-10-19T07:46:01.583868053Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792363991","title":"TuxCare security update for @next/mdx (5 CVEs)","description":"TuxCare rebuilt @next/mdx to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-18T22:53:08Z","modified":"2026-10-19T07:46:05.853184764Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792367398","title":"TuxCare security update for @next/swc-linux-arm64-gnu (5 CVEs)","description":"TuxCare rebuilt @next/swc-linux-arm64-gnu to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.","status":"published","published":"2026-10-18T23:49:54Z","modified":"2026-10-19T07:46:33.864152976Z","updated_at":"2026-11-02T15:43:53.353888Z"},{"id":"ROOT-APP-NPM-CVE-2026-94486","title":"CVE-2026-94486 in next - Patched by Root","description":"Root has patched CVE-2026-94486 in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-30T13:03:23Z","modified":"2026-10-30T14:15:03.204782504Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}