Next.js image optimization can reach a private address from an allow-listed URL
On September 30, 2026, Next.js published a high-severity image-optimization bug, CVE-2026-94483. From next 16.0.0 until 16.3.8, an allow-listed remote image URL can be resolved to a private address. Apps with no images.remotePatterns are not affected. The fix is 16.3.8.