Next.js image optimization can reach a private address from an allow-listed URL
On September 30, 2026, Next.js published a high-severity image-optimization bug, CVE-2026-94483. From next 16.0.0 until 16.3.8, an allow-listed remote image URL can be resolved to a private address. Apps with no images.remotePatterns are not affected. The fix is 16.3.8.
What was reported
The September 30, 2026 Next.js security release lists CVE-2026-94483 / GHSA-cjq9-62q9-8jv4 as a high-severity server-side request forgery in image optimization. An attacker-controlled URL that already matches images.remotePatterns can be fetched from a private address, for example a private IP range. The release post says that if no images.remotePatterns are configured, the application is not affected.
CVE-2026-94483, in the record published October 2, 2026, says the affected range is next 16.0.0 until 16.3.8, and that 16.3.8 is the fix. It says image optimization can follow attacker-controlled DNS resolution for a remote URL after that URL has passed the allow-list check. The record's workaround is to audit allow-listed hosts and avoid entries whose DNS records are not trusted.
The September 30 post also ships 15.5.27 for that release. This CVE record's affected product range is 16.0.0 until 16.3.8. This note does not add 15.x to that range.
How to prevent it
Upgrade next to 16.3.8 or later if you are on 16.0.0 before 16.3.8 and images.remotePatterns allows remote URLs. The CVE record says applications without images.remotePatterns are not affected. If you cannot upgrade yet, audit the allow-listed hosts and drop entries whose DNS records you do not trust.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.