Packages / next / Security

HighVulnerabilityGHSA-cjq9-62q9-8jv4CVE-2026-94483Published 7 Oct 2026

Next.js has Server-Side Request Forgery in Image Optimization

Affected releases · next

  • 16.x16.0.0 – 16.3.7Fixed in 16.3.8

On 16.x, the newest line:

npm install next@16.3.8

  1. Not affected

    0.1.0 – 15.5.28

    378 releases

  2. Affected

    16.0.0 – 16.3.7

    41 releases

  3. Fixed

    16.3.8 – 16.4.2

    4 releases, latest

423 stable releases of next, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Impact

An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization.

Workaround

Audit allow-listed remote URLs in images.remotePatterns (see nextjs.org/docs/app/getting-started/images) for hosts that may not be trusted with their DNS entries. If no images.remotePatterns are configured, your app is not affected.