CVE-2026-94483
Next.js: Server-Side Request Forgery in Image Optimization
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Next.js: Server-Side Request Forgery in Image Optimization
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.
- Record
CVE-2026-94483- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2026-91671
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.
- Record
EUVD-2026-91671- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cjq9-62q9-8jv4
Next.js has Server-Side Request Forgery in Image Optimization
Impact
An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization.
Workaround
Audit allow-listed remote URLs in images.remotePatterns (see https://nextjs.org/docs/app/getting-started/images#remote-images) for hosts that may not be trusted with their DNS entries. If no images.remotePatterns are configured, your app is not affected.
- Record
GHSA-cjq9-62q9-8jv4- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
NVD
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.
- Record
CVE-2026-94483- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
Next.js: Server-Side Request Forgery in Image Optimization
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.
- Record
CVE-2026-94483- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVGHSA-cjq9-62q9-8jv4
Next.js has Server-Side Request Forgery in Image Optimization
Impact
An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization.
Workaround
Audit allow-listed remote URLs in images.remotePatterns (see https://nextjs.org/docs/app/getting-started/images#remote-images) for hosts that may not be trusted with their DNS entries. If no images.remotePatterns are configured, your app is not affected.
- Record
GHSA-cjq9-62q9-8jv4- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
Show 15 moreShow less
OSVCLSA-2026-1791978826 No score
TuxCare security update for next (5 CVEs)
TuxCare rebuilt next to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.
- Record
CLSA-2026-1791978826- Updated
- 2026-11-02
OSVCLSA-2026-1792195752 No score
TuxCare security update for create-next-app (5 CVEs)
TuxCare rebuilt create-next-app to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.
- Record
CLSA-2026-1792195752- Updated
- 2026-11-02
OSVCLSA-2026-1792196732 No score
TuxCare security update for @next/eslint-plugin-next (5 CVEs)
TuxCare rebuilt @next/eslint-plugin-next to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.
- Record
CLSA-2026-1792196732- Updated
- 2026-11-02
OSVCLSA-2026-1792206293 No score
TuxCare security update for @next/bundle-analyzer (5 CVEs)
TuxCare rebuilt @next/bundle-analyzer to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.
- Record
CLSA-2026-1792206293- Updated
- 2026-11-02
OSVCLSA-2026-1792256970 No score
TuxCare security update for next-rspack (5 CVEs)
TuxCare rebuilt next-rspack to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.
- Record
CLSA-2026-1792256970- Updated
- 2026-11-02
OSVCLSA-2026-1792272234 No score
TuxCare security update for @next/plugin-storybook (5 CVEs)
TuxCare rebuilt @next/plugin-storybook to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.
- Record
CLSA-2026-1792272234- Updated
- 2026-11-02
OSVCLSA-2026-1792293005 No score
TuxCare security update for @next/polyfill-module (5 CVEs)
TuxCare rebuilt @next/polyfill-module to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.
- Record
CLSA-2026-1792293005- Updated
- 2026-11-02
OSVCLSA-2026-1792304725 No score
TuxCare security update for @next/polyfill-nomodule (5 CVEs)
TuxCare rebuilt @next/polyfill-nomodule to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.
- Record
CLSA-2026-1792304725- Updated
- 2026-11-02
OSVCLSA-2026-1792326298 No score
TuxCare security update for @next/react-refresh-utils (5 CVEs)
TuxCare rebuilt @next/react-refresh-utils to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.
- Record
CLSA-2026-1792326298- Updated
- 2026-11-02
OSVCLSA-2026-1792338248 No score
TuxCare security update for @next/third-parties (5 CVEs)
TuxCare rebuilt @next/third-parties to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.
- Record
CLSA-2026-1792338248- Updated
- 2026-11-02
OSVCLSA-2026-1792346474 No score
TuxCare security update for @next/swc-linux-x64-gnu (5 CVEs)
TuxCare rebuilt @next/swc-linux-x64-gnu to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.
- Record
CLSA-2026-1792346474- Updated
- 2026-11-02
OSVCLSA-2026-1792358591 No score
TuxCare security update for @next/codemod (5 CVEs)
TuxCare rebuilt @next/codemod to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.
- Record
CLSA-2026-1792358591- Updated
- 2026-11-02
OSVCLSA-2026-1792363991 No score
TuxCare security update for @next/mdx (5 CVEs)
TuxCare rebuilt @next/mdx to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.
- Record
CLSA-2026-1792363991- Updated
- 2026-11-02
OSVCLSA-2026-1792367398 No score
TuxCare security update for @next/swc-linux-arm64-gnu (5 CVEs)
TuxCare rebuilt @next/swc-linux-arm64-gnu to address 5 CVEs. Fixed in 16.0.6-tuxcare.13.
- Record
CLSA-2026-1792367398- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-94483 No score
CVE-2026-94483 in next - Patched by Root
Root has patched CVE-2026-94483 in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-94483- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nextnpm |
16.0.0 up to 16.3.8 | 16.3.8 |
nextTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.13, plus listed versions 16.0.616.0.6-tuxcare.116.0.6-tuxcare.1016.0.6-tuxcare.1116.0.6-tuxcare.12 Show 8 moreShow less16.0.6-tuxcare.216.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.516.0.6-tuxcare.616.0.6-tuxcare.716.0.6-tuxcare.816.0.6-tuxcare.9 |
16.0.6-tuxcare.13 |
create-next-appTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.13, plus listed versions 16.0.616.0.6-tuxcare.1016.0.6-tuxcare.1216.0.6-tuxcare.316.0.6-tuxcare.4 Show 5 moreShow less16.0.6-tuxcare.516.0.6-tuxcare.616.0.6-tuxcare.716.0.6-tuxcare.816.0.6-tuxcare.9 |
16.0.6-tuxcare.13 |
@next/eslint-plugin-nextTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.13, plus listed versions 16.0.616.0.6-tuxcare.1016.0.6-tuxcare.1216.0.6-tuxcare.316.0.6-tuxcare.4 Show 5 moreShow less16.0.6-tuxcare.516.0.6-tuxcare.616.0.6-tuxcare.716.0.6-tuxcare.816.0.6-tuxcare.9 |
16.0.6-tuxcare.13 |
@next/bundle-analyzerTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.13, plus listed versions 16.0.616.0.6-tuxcare.1016.0.6-tuxcare.1216.0.6-tuxcare.316.0.6-tuxcare.4 Show 5 moreShow less16.0.6-tuxcare.516.0.6-tuxcare.616.0.6-tuxcare.716.0.6-tuxcare.816.0.6-tuxcare.9 |
16.0.6-tuxcare.13 |
next-rspackTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.13, plus listed versions 16.0.616.0.6-tuxcare.1016.0.6-tuxcare.1216.0.6-tuxcare.316.0.6-tuxcare.4 Show 5 moreShow less16.0.6-tuxcare.516.0.6-tuxcare.616.0.6-tuxcare.716.0.6-tuxcare.816.0.6-tuxcare.9 |
16.0.6-tuxcare.13 |
@next/plugin-storybookTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.13, plus listed versions 16.0.616.0.6-tuxcare.1016.0.6-tuxcare.1216.0.6-tuxcare.316.0.6-tuxcare.4 Show 5 moreShow less16.0.6-tuxcare.516.0.6-tuxcare.616.0.6-tuxcare.716.0.6-tuxcare.816.0.6-tuxcare.9 |
16.0.6-tuxcare.13 |
@next/polyfill-moduleTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.13, plus listed versions 16.0.616.0.6-tuxcare.1016.0.6-tuxcare.1216.0.6-tuxcare.316.0.6-tuxcare.4 Show 5 moreShow less16.0.6-tuxcare.516.0.6-tuxcare.616.0.6-tuxcare.716.0.6-tuxcare.816.0.6-tuxcare.9 |
16.0.6-tuxcare.13 |
@next/polyfill-nomoduleTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.13, plus listed versions 16.0.616.0.6-tuxcare.1016.0.6-tuxcare.1216.0.6-tuxcare.316.0.6-tuxcare.4 Show 5 moreShow less16.0.6-tuxcare.516.0.6-tuxcare.616.0.6-tuxcare.716.0.6-tuxcare.816.0.6-tuxcare.9 |
16.0.6-tuxcare.13 |
@next/react-refresh-utilsTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.13, plus listed versions 16.0.616.0.6-tuxcare.1016.0.6-tuxcare.1216.0.6-tuxcare.316.0.6-tuxcare.4 Show 5 moreShow less16.0.6-tuxcare.516.0.6-tuxcare.616.0.6-tuxcare.716.0.6-tuxcare.816.0.6-tuxcare.9 |
16.0.6-tuxcare.13 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
@next/third-partiesTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.13, plus listed versions 16.0.616.0.6-tuxcare.1016.0.6-tuxcare.1216.0.6-tuxcare.316.0.6-tuxcare.4 Show 5 moreShow less16.0.6-tuxcare.516.0.6-tuxcare.616.0.6-tuxcare.716.0.6-tuxcare.816.0.6-tuxcare.9 |
16.0.6-tuxcare.13 |
@next/swc-linux-x64-gnuTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.13, plus listed versions 16.0.616.0.6-tuxcare.1016.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5 Show 4 moreShow less16.0.6-tuxcare.616.0.6-tuxcare.716.0.6-tuxcare.816.0.6-tuxcare.9 |
16.0.6-tuxcare.13 |
@next/codemodTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.13, plus listed versions 16.0.616.0.6-tuxcare.1016.0.6-tuxcare.1216.0.6-tuxcare.316.0.6-tuxcare.4 Show 5 moreShow less16.0.6-tuxcare.516.0.6-tuxcare.616.0.6-tuxcare.716.0.6-tuxcare.816.0.6-tuxcare.9 |
16.0.6-tuxcare.13 |
@next/mdxTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.13, plus listed versions 16.0.616.0.6-tuxcare.1016.0.6-tuxcare.1216.0.6-tuxcare.316.0.6-tuxcare.4 Show 5 moreShow less16.0.6-tuxcare.516.0.6-tuxcare.616.0.6-tuxcare.716.0.6-tuxcare.816.0.6-tuxcare.9 |
16.0.6-tuxcare.13 |
@next/swc-linux-arm64-gnuTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.13, plus listed versions 16.0.616.0.6-tuxcare.1016.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5 Show 4 moreShow less16.0.6-tuxcare.616.0.6-tuxcare.716.0.6-tuxcare.816.0.6-tuxcare.9 |
16.0.6-tuxcare.13 |
nextRoot:npm |
before 16.3.3-aikido.2 | 16.3.3-aikido.216.3.6-aikido.116.3.3-aikido.316.3.3-aikido.416.3.6-aikido.216.3.8-aikido.1 |
@rootio/nextRoot:npm |
before 16.3.3-root.io.2 | 16.3.3-root.io.216.3.6-root.io.116.3.3-root.io.316.3.3-root.io.416.3.6-root.io.216.3.8-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-94483 is a high vulnerability (CVSS 8.3) in Vercel Next.js, published October 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in next 16.3.8.
References
github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4
nvd.nist.gov/vuln/detail/CVE-2026-94483