CVE-2026-94483: Next.js Server-Side Request Forgery in Image Optimization
Summary
CVE-2026-94483: Next.js has Server-Side Request Forgery in Image Optimization. Affects next versions >= 16.0.0, < 16.3.8. Fixed in 16.3.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Next.js is a popular React framework that enables developers to build server-rendered applications with ease. It provides features such as automatic code splitting, server-side rendering, and static site generation. However, a recent vulnerability has been identified that affects its image optimization functionality, potentially allowing attackers to exploit server-side request forgery (SSRF) vulnerabilities.
Vulnerability Detail
The vulnerability arises from the handling of allow-listed remote URLs during the image optimization process. An attacker can manipulate these URLs to perform SSRF attacks, which may allow them to access internal services or private IP addresses that should not be exposed to the public. This can lead to unauthorized data access or further exploitation of the server.
How To Fix
Latest published version: 16.4.2 as of 22 Oct 2026
npm install next@16.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
16.3.8
This is the first release that contains the fix.
npm install next@16.3.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, audit the allow-listed remote URLs in the 'images.remotePatterns' configuration. Ensure that only trusted hosts are included. If no 'images.remotePatterns' are configured, your application is not affected. Example configuration: { images: { remotePatterns: [{ protocol: 'https', hostname: 'trusted.com', port: '' }] } }
Conclusion
The CVE-2026-94483 vulnerability in Next.js highlights the importance of careful management of allow-listed URLs in image optimization. By updating to the patched version and auditing your configurations, you can protect your application from potential SSRF attacks.
See every vulnerability recorded for next →
FAQ
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities without requiring any signup.
Exploitation of this vulnerability could lead to unauthorized access to sensitive internal services, data leakage, or further attacks on the server.
Yes, you can mitigate the risk by auditing the allow-listed remote URLs and ensuring that only trusted hosts are included in your configuration.
The CVSS score for this vulnerability is 6.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for next.
