CVE-2026-94483: Next.js: Server-Side Request Forgery in Image Optimization
Impact
An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization.
Workaround
Audit allow-listed remote URLs in images.remotePatterns (see https://nextjs.org/docs/app/getting-started/images#remote-images) for hosts that may not be trusted with their DNS entries. If no images.remotePatterns are configured, your app is not affected.
Other sources
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.3.8 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 16.3.8 - Compensating control
Audit allow-listed remote URLs in images.remotePatterns and avoid entries whose hosts may not be trusted with their DNS entries.
Event History
Frequently Asked Questions
Which deployments are affected?
Applications using Next.js Image Optimization with images.remotePatterns configured are affected in versions from 16.0.0 up to, but not including, 16.3.8. Applications without images.remotePatterns are not affected.
What does an attacker need to exploit this issue?
An attacker needs to supply a remote image URL that matches an allowed images.remotePatterns entry. The issue occurs when the hostname passes the allow-list check but its DNS resolution leads the optimized image fetch to a private IP address.
What should be done if upgrading is not immediately possible?
Audit the hosts allowed by images.remotePatterns and avoid entries whose DNS records are not trusted. Upgrade to Next.js 16.3.8 when possible.