---
id: "CVE-2026-94483"
page: "https://infrastack.ai/live/CVE-2026-94483"
kind: "vulnerability"
aliases: ["CVE-2026-94483", "GHSA-cjq9-62q9-8jv4"]
title: "Next.js has Server-Side Request Forgery in Image Optimization"
severity: "high"
cvss: 8.3
epss: 0.0033
exploited: false
status: "open"
category: "package"
products: [{"name": "next", "note": ">= 16.0.0 < 16.3.?", "fixed": ["16.3.?"], "affected": "", "ecosystem": "npm"}, {"name": "next", "fixed": ["16.3.8"], "affected": ">= 16.0.0, < 16.3.8", "ecosystem": "npm"}, {"name": "vercel next.js", "fixed": ["16.3.8"], "affected": ">= 16.0.0, < 16.3.8", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["cwe-918", "next.js", "node", "package", "self-hosted"]
not_affected_if: ["no-remote-patterns", "static-export"]
published_at: "2026-09-30T16:15:36+00:00"
first_seen_at: "2026-11-09T22:53:14+00:00"
updated_at: "2026-11-09T23:10:12+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4", "first_seen_at": "2026-11-09T22:53:14+00:00"}, {"source": "ghsa", "url": "https://github.com/advisories/GHSA-cjq9-62q9-8jv4", "first_seen_at": "2026-11-09T22:57:50+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94483", "first_seen_at": "2026-11-09T23:10:12+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.0033, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-94483"}]
---

# Next.js has Server-Side Request Forgery in Image Optimization

Link for people: https://infrastack.ai/live/CVE-2026-94483 (this .md is for agents)

Next.js Image Optimization can be made to fetch an attacker-chosen remote URL, including private IP addresses, so the server makes requests on the attacker's behalf. An attacker can reach internal services the server can see, which the sources describe as server-side request forgery.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:next affected range not listed fixed 16.3.?
- npm:next affected >= 16.0.0, < 16.3.8 fixed 16.3.8
- vendor:vercel next.js affected >= 16.0.0, < 16.3.8 fixed 16.3.8

## How to check

- Look for `images.remotePatterns` in `next.config.js` or `next.config.mjs`; if none are configured, the sources say the app is not affected.
- Check the installed version with `npm ls next`; versions from `>= 16.0.0` and `< 16.3.8` are in range.
- Review each host allowed in `images.remotePatterns` and confirm its DNS entries are trusted.

## Fix

- `next` `16.3.8` (fixed version for the 16.x line in the product ranges)
- Audit hosts in `images.remotePatterns` for hosts whose DNS may not be trusted, per the maintainer's workaround.

## Timeline

- 2026-11-09T22:53:14+00:00 ghsa-repo https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4
- 2026-11-09T22:57:50+00:00 ghsa https://github.com/advisories/GHSA-cjq9-62q9-8jv4
- 2026-11-09T23:10:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94483

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4
- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/vercel/next.js/security-advisories/GHSA-cjq9-62q9-8jv4
- [fix] Patch: github.com https://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b
- [fix] Release notes: github.com https://github.com/vercel/next.js/releases/tag/v16.3.8

## From the sources

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_