Next.js has Server-Side Request Forgery in Image Optimization

TRUNG BÌNH 6.5CVE-2026-94483 · GHSA-cjq9-62q9-8jv4 · Công bố 02/10/2026 · cập nhật 06/10/2026

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
next.js vercel	`≥ 16.0.0, < 16.3.8`	`16.3.8`
next npm	`≥ 16.0.0, < 16.3.8`	`16.3.8`

Mô tả

Impact

An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization.

Workaround

Audit allow-listed remote URLs in images.remotePatterns (see https://nextjs.org/docs/app/getting-started/images#remote-images) for hosts that may not be trusted with their DNS entries. If no images.remotePatterns are configured, your app is not affected.

Mô tả của NVD

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.

Tham khảo

vercel/next.js security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-94483 · ADVISORY
vercel/next.js commit e002ad6 · WEB
vercel/next.js · PACKAGE
vercel/next.js release v16.3.8 · WEB

Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.

Quét site miễn phí

Gói / sản phẩm

Phiên bản bị ảnh hưởng

Phiên bản đã vá

next.js

vercel

≥ 16.0.0, < 16.3.8

16.3.8