Next.js has Server-Side Request Forgery in Image Optimization

MEDIUM 6.5CVE-2026-94483 · GHSA-cjq9-62q9-8jv4 · Published 02/10/2026 · updated 06/10/2026

Package	Affected versions	Patched versions
next.js vercel	`≥ 16.0.0, < 16.3.8`	`16.3.8`
next npm	`≥ 16.0.0, < 16.3.8`	`16.3.8`

Description

Impact

An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization.

Workaround

Audit allow-listed remote URLs in images.remotePatterns (see https://nextjs.org/docs/app/getting-started/images#remote-images) for hosts that may not be trusted with their DNS entries. If no images.remotePatterns are configured, your app is not affected.

NVD description

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.

References

vercel/next.js security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-94483 · ADVISORY
vercel/next.js commit e002ad6 · WEB
vercel/next.js · PACKAGE
vercel/next.js release v16.3.8 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

next.js

vercel

≥ 16.0.0, < 16.3.8

16.3.8

npm

≥ 16.0.0, < 16.3.8

16.3.8

Description

Impact

An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization.

Workaround

NVD description