{"id":"CVE-2026-94483","kind":"vulnerability","aliases":["CVE-2026-94483","GHSA-cjq9-62q9-8jv4"],"related":[],"title":"Next.js has Server-Side Request Forgery in Image Optimization","description":"Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.","summary":"Next.js Image Optimization can be made to fetch an attacker-chosen remote URL, including private IP addresses, so the server makes requests on the attacker's behalf. An attacker can reach internal services the server can see, which the sources describe as server-side request forgery.","severity":"high","cvss":8.3,"epss":0.0033,"exploited":false,"exploited_at":null,"products":[{"name":"next","note":">= 16.0.0 < 16.3.?","fixed":["16.3.?"],"affected":"","ecosystem":"npm"},{"name":"next","fixed":["16.3.8"],"affected":">= 16.0.0, < 16.3.8","ecosystem":"npm"},{"name":"vercel next.js","fixed":["16.3.8"],"affected":">= 16.0.0, < 16.3.8","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cwe-918","next.js","node","package","self-hosted"],"not_affected_if":["no-remote-patterns","static-export"],"how_to_check":"- Look for `images.remotePatterns` in `next.config.js` or `next.config.mjs`; if none are configured, the sources say the app is not affected.\n- Check the installed version with `npm ls next`; versions from `>= 16.0.0` and `< 16.3.8` are in range.\n- Review each host allowed in `images.remotePatterns` and confirm its DNS entries are trusted.","fix":"- `next` `16.3.8` (fixed version for the 16.x line in the product ranges)\n- Audit hosts in `images.remotePatterns` for hosts whose DNS may not be trusted, per the maintainer's workaround.","status":"open","published_at":"2026-09-30T16:15:36+00:00","first_seen_at":"2026-11-09T22:53:14+00:00","triaged_at":"2026-11-09T22:59:05+00:00","updated_at":"2026-11-09T23:10:12+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T22:59:05Z","model":"claude-haiku-5-5","output":{"fix":"- `next` `16.3.8` (fixed version for the 16.x line in the product ranges)\n- Audit hosts in `images.remotePatterns` for hosts whose DNS may not be trusted, per the maintainer's workaround.","reach":"internet","title":"Next.js: image optimization lets attackers reach private internal servers","impact":"medium","summary":"Next.js Image Optimization can be made to fetch an attacker-chosen remote URL, including private IP addresses, so the server makes requests on the attacker's behalf. An attacker can reach internal services the server can see, which the sources describe as server-side request forgery.","audience":"developers","category":"package","nicknames":[],"who_cares":["next.js","self-hosted","node"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"server makes requests to private internal addresses on attacker's behalf","analyst_note":"","how_to_check":"- Look for `images.remotePatterns` in `next.config.js` or `next.config.mjs`; if none are configured, the sources say the app is not affected.\n- Check the installed version with `npm ls next`; versions from `>= 16.0.0` and `< 16.3.8` are in range.\n- Review each host allowed in `images.remotePatterns` and confirm its DNS entries are trusted.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-remote-patterns","static-export"],"who_is_affected":"Apps built with Next.js 16.0.0 up to but not including 16.3.8 that use Image Optimization with `images.remotePatterns` configured. The sources say apps with no `images.remotePatterns` are not affected, and the attacker must be able to control a URL on an allow-listed host's DNS. Teams on managed hosting that does not run the Next.js image optimizer may be less exposed, but the sources do not say which hosts are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000823,"input_tokens":4815,"output_tokens":683,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,20A '-918':27B '-94483':13A,21A '16.0.0':95C '16.3.8':97C,164C '62q9':17A '8jv4':18A 'address':51B,123C 'administr':139C 'affect':138C 'allow':114C,130C,146C 'allow-list':129C,145C 'applic':93C,133C 'attack':44B,59B,63B,103C 'attacker-chosen':43B 'attacker-control':102C 'audit':144C 'avoid':150C 'behalf':61B 'build':88C 'check':132C 'chosen':45B 'cjq9':16A 'control':104C 'cve':11A,19A 'cwe':26B 'describ':75B 'dns':105C,153C 'entri':151C 'fetch':41B,118C 'fix':161C 'follow':101C 'forgeri':7A,81B 'framework':86C 'full':90C 'full-stack':89C 'ghsa':15A 'ghsa-cjq9-62q9-8jv4':14A 'host':33B,148C 'imag':9A,35B,98C,117C 'images.remotepatterns':113C,135C 'includ':48B 'intern':66B 'ip':50B,122C 'issu':159C 'list':131C,147C 'made':39B 'make':55B 'match':112C 'next':22A,23A 'next.js':1A,25A,28B,34B,82C 'node':29B 'optim':10A,36B,99C,116C 'packag':30B 'pass':127C 'privat':49B,121C 'reach':65B,120C 'react':85C 'record':154C 'remot':46B,109C 'request':6A,56B,80B 'resolut':106C 'see':71B 'self':32B 'self-host':31B 'server':4A,54B,69B,78B 'server-sid':3A,77B 'servic':67B 'side':5A,79B 'sourc':74B 'stack':91C 'trust':157C 'unabl':140C 'upgrad':142C 'url':47B,110C,126C 'vercel':24A 'version':163C 'web':92C 'whose':152C 'without':134C","nicknames":[],"mitigations":[],"who_affected":"Apps built with Next.js 16.0.0 up to but not including 16.3.8 that use Image Optimization with `images.remotePatterns` configured. The sources say apps with no `images.remotePatterns` are not affected, and the attacker must be able to control a URL on an allow-listed host's DNS. Teams on managed hosting that does not run the Next.js image optimizer may be less exposed, but the sources do not say which hosts are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["next","nextjs","vercelnextjs"],"ptokens":["next","nextjs","vercel"],"labels":["cwe918","high","nextjs","node","npm","package","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':12A,20A '-94483':13A,21A '62q9':17A '8jv4':18A 'cjq9':16A 'cve':11A,19A 'forgeri':7A 'ghsa':15A 'ghsa-cjq9-62q9-8jv4':14A 'imag':9A 'next':22A,23A 'next.js':1A,25A 'optim':10A 'request':6A 'server':4A 'server-sid':3A 'side':5A 'vercel':24A","search_b":"'-918':27B 'address':51B 'attack':44B,59B,63B 'attacker-chosen':43B 'behalf':61B 'chosen':45B 'cwe':26B 'describ':75B 'fetch':41B 'forgeri':81B 'host':33B 'imag':35B 'includ':48B 'intern':66B 'ip':50B 'made':39B 'make':55B 'next.js':28B,34B 'node':29B 'optim':36B 'packag':30B 'privat':49B 'reach':65B 'remot':46B 'request':56B,80B 'see':71B 'self':32B 'self-host':31B 'server':54B,69B,78B 'server-sid':77B 'servic':67B 'side':79B 'sourc':74B 'url':47B","search_c":"'16.0.0':95C '16.3.8':97C,164C 'address':123C 'administr':139C 'affect':138C 'allow':114C,130C,146C 'allow-list':129C,145C 'applic':93C,133C 'attack':103C 'attacker-control':102C 'audit':144C 'avoid':150C 'build':88C 'check':132C 'control':104C 'dns':105C,153C 'entri':151C 'fetch':118C 'fix':161C 'follow':101C 'framework':86C 'full':90C 'full-stack':89C 'host':148C 'imag':98C,117C 'images.remotepatterns':113C,135C 'ip':122C 'issu':159C 'list':131C,147C 'match':112C 'next.js':82C 'optim':99C,116C 'pass':127C 'privat':121C 'reach':120C 'react':85C 'record':154C 'remot':109C 'resolut':106C 'stack':91C 'trust':157C 'unabl':140C 'upgrad':142C 'url':110C,126C 'version':163C 'web':92C 'whose':152C 'without':134C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-30T16:15:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-cjq9-62q9-8jv4","url":"https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4","severity":"high","published_at":"2026-09-30T16:15:36+00:00","modified_at":"2026-09-30T16:15:36+00:00","first_seen_at":"2026-11-09T22:53:14+00:00","fetched_at":"2026-11-09T22:53:14+00:00","note":null},{"source":"ghsa","external_id":"GHSA-cjq9-62q9-8jv4","url":"https://github.com/advisories/GHSA-cjq9-62q9-8jv4","severity":"high","published_at":"2026-10-07T20:30:55+00:00","modified_at":"2026-10-07T20:30:56+00:00","first_seen_at":"2026-11-09T22:57:50+00:00","fetched_at":"2026-11-09T22:57:50+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-94483","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94483","severity":null,"published_at":"2026-10-02T16:16:51+00:00","modified_at":"2026-10-06T17:17:27+00:00","first_seen_at":"2026-11-09T23:10:12+00:00","fetched_at":"2026-11-09T23:10:12+00:00","note":null}],"documents":[{"id":110401,"url":"https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-09-30T16:15:36+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":110763,"url":"https://api.github.com/repos/vercel/next.js/security-advisories/GHSA-cjq9-62q9-8jv4","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":110765,"url":"https://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":43051,"url":"https://github.com/vercel/next.js/releases/tag/v16.3.8","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[{"type":"epss","score":0.0033,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94483"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}