MajorCritical vulnerability
CVE-2026-94483: Next.js has Server-Side Request Forgery in Image Optimization
GitHub Advisories · officialPublished Oct 7, 2026Risk 37/100
## Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization. ## Workaround Audit allow-listed remote URLs in `images.remotePatterns` (see https://nextjs.org/docs/app/getting-started/images#remote-images) for hosts that may not be trusted with their DNS entries. If no `images.remotePatterns` are configured, your app is not affected.
Recommended action
Recommended action
Upgrade affected packages to a patched version: next 16.3.8.
Technical details
- Vendor
- Not specified
- Product
- next
- Exploitation
- none known
- Evidence
- official
CVSS
6.5
Evidence and sources
This record is attributed to GitHub Advisories. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source