CVE-2026-94483 — Next.js: Server-Side Request Forgery in Image Optimization
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote UR…
Published: 2026-10-02 · CVSS: 8.3 · CVSS 4.0
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7