CVE-2026-94483 Overview
CVE-2026-94483 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the Next.js Image Optimization feature. The flaw affects versions 16.0.0 through 16.3.7 and allows the optimized image fetch to follow attacker-controlled DNS resolution. A remote URL that initially passes the images.remotePatterns allow-list check can resolve to a private IP address at fetch time. Applications that do not configure images.remotePatterns are not affected. The issue is fixed in Next.js 16.3.8.
Critical Impact
Attackers can abuse the Image Optimization endpoint to reach internal services and private network resources behind the Next.js server.
Affected Products
- Vercel Next.js 16.0.0 through 16.3.7
- Node.js deployments of Next.js with images.remotePatterns configured
- Self-hosted Next.js applications using the built-in Image Optimization pipeline
Discovery Timeline
- 2026-10-02 - CVE-2026-94483 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-94483
Vulnerability Analysis
Next.js Image Optimization accepts a remote URL, validates it against the images.remotePatterns allow-list, and then fetches the image for processing. The validation step and the fetch step both resolve DNS independently. An attacker-controlled hostname that matches the allow-list can return a public IP address during validation and a private IP address during the subsequent fetch. This classic DNS rebinding pattern turns a legitimate image proxy into an outbound request primitive against internal infrastructure.
The fix in version 16.3.8 closes the gap between validation and fetch so that the resolved address used for the outbound request is checked against the allow-list policy and private IP ranges.
Root Cause
The root cause is a time-of-check to time-of-use (TOCTOU) condition in the Image Optimization URL handling. The allow-list check validates the hostname, but DNS resolution occurs again at request time without reusing or re-validating the resolved address. Hosts whose authoritative DNS the attacker controls can serve different answers across the two lookups.
Attack Vector
Exploitation requires that the target application configures images.remotePatterns and that an attacker-controlled hostname matches one of the allow-listed patterns. The attacker configures their authoritative DNS to alternate responses between a public address (to pass the allow-list check) and an internal RFC1918 address such as 127.0.0.1, 169.254.169.254, or 10.0.0.0/8. A request to the /_next/image endpoint with the attacker URL causes the server to fetch content from the private address and return response data through the image pipeline. This can expose cloud instance metadata, internal admin interfaces, and other services not intended to be reachable from the internet. Technical details are available in the GitHub Security Advisory GHSA-cjq9-62q9-8jv4 and the upstream patch commit.
Detection Methods for CVE-2026-94483
Indicators of Compromise
- Requests to /_next/image with url parameters pointing to hostnames with unusually low DNS time-to-live (TTL) values.
- Outbound connections from the Next.js server process to RFC1918 ranges, link-local 169.254.169.254, or localhost immediately after image proxy requests.
- Responses from the image endpoint containing non-image payloads such as JSON metadata or HTML admin pages.
Detection Strategies
- Correlate inbound /_next/image requests with outbound DNS lookups and subsequent HTTP connections from the application server.
- Alert when the Next.js runtime initiates connections to internal subnets, cloud metadata endpoints, or Kubernetes API addresses.
- Baseline the set of hostnames referenced through Image Optimization and flag first-seen or short-TTL domains.
Monitoring Recommendations
- Enable verbose access logging on the Image Optimization route and ship logs to a centralized store for retrospective hunting.
- Monitor DNS resolver logs for queries originating from the Next.js host that resolve to private IP space.
- Review web application firewall (WAF) and egress proxy telemetry for anomalous destination addresses tied to image proxy traffic.
How to Mitigate CVE-2026-94483
Immediate Actions Required
- Upgrade Next.js to version 16.3.8 or later on all affected deployments.
- Audit images.remotePatterns entries and remove any hostnames whose DNS records are not under trusted control.
- Restrict egress from the Next.js server so it cannot reach internal management networks or cloud metadata services.
Patch Information
The vulnerability is fixed in Next.js 16.3.8. See the GitHub Release v16.3.8 and the fix commit e002ad68 for full details.
Workarounds
- Remove images.remotePatterns entirely if remote image sources are not required, as applications without this configuration are not affected.
- Replace broad wildcard patterns with explicit hostnames whose DNS zones you control directly.
- Route outbound image fetches through an egress proxy that blocks private IP ranges and the cloud metadata address 169.254.169.254.
# Upgrade Next.js to the patched release
npm install next@16.3.8
# or
pnpm add next@16.3.8
# or
yarn add next@16.3.8
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
