GitHub Advisoryadvisory · npm

GHSA-cjq9-62q9-8jv4 Next.js has Server-Side Request Forgery in Image Optimization

HIGH Published 2026-10-07 Modified 2026-10-07 Official page ↗
Aliases
CVE-2026-94483
Ecosystem
npm
Packages
next
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-918
Reviewed
2026-10-07

Affected packages

• npm next: >= 16.0.0, < 16.3.8 → fixed in 16.3.8

Description

Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization. Workaround Audit allow-listed remote URLs in `images.remotePatterns` (see https://nextjs.org/docs/app/getting-started/images#remote-images) for hosts that may not be trusted with their DNS entries. If no `images.remotePatterns` are configured, your app is not affected.

Related

Alias · CVE (1)

  • CVE-2026-94483 Next.js is a React framework for building full-stack web applications. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References