NEXT · CVE-2026-94483 · Package
FIX → 16.3.8 +1
Next.js Image Optimization can be made to fetch an attacker-chosen remote URL, including private IP addresses, so the server makes requests on the attacker's behalf. An attacker can reach internal services the server can see, which the sources describe as server-side request forgery.
first public Sep 30, 2026 · 3 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Apps built with Next.js 16.0.0 up to but not including 16.3.8 that use Image Optimization with images.remotePatterns configured. The sources say apps with no images.remotePatterns are not affected, and the attacker must be able to control a URL on an allow-listed host's DNS. Teams on managed hosting that does not run the Next.js image optimizer may be less exposed, but the sources do not say which hosts are affected.
Not affected if no-remote-patterns, static-export
Who cares next.js, node, self-hosted
images.remotePatterns in next.config.js or next.config.mjs; if none are configured, the sources say the app is not affected.Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
npm ls next; versions from >= 16.0.0 and < 16.3.8 are in range.images.remotePatterns and confirm its DNS entries are trusted.Upgrade to 16.3.8 +1
next 16.3.8 (fixed version for the 16.x line in the product ranges)images.remotePatterns for hosts whose DNS may not be trusted, per the maintainer's workaround.GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.