CVE-2026-94483 in Next.js
Summary
by MITRE • 10/02/2026
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified within Next.js versions ranging from 16.0.0 through 16.3.8 represents a significant security flaw in the Image Optimization module, specifically concerning how remote URLs are resolved and validated against configured allow-lists. This issue stems from an improper restriction of DNS resolution behavior during the image fetching process. When an application is configured with images.remotePatterns to define which external domains are permitted for optimization, the framework performs a validation check to ensure the target URL matches one of these allowed patterns before proceeding with the fetch operation. However, this validation occurs prior to the actual network request and does not account for potential DNS rebinding or resolution manipulation that can occur after the initial pattern match but before the connection is established. Consequently, an attacker who controls a domain listed in the remotePatterns configuration can exploit this timing gap by manipulating their DNS records to resolve to private IP addresses, such as those found on internal networks like 10.x.x.x, 172.16.x.x, or 192.168.x.x.
This technical flaw allows for a form of Server-Side Request Forgery where the server is tricked into making requests to internal resources that are typically inaccessible from the public internet. The operational impact of this vulnerability is severe in environments where Next.js applications have access to sensitive internal services, databases, or administrative interfaces. By leveraging DNS resolution manipulation, an attacker can bypass network perimeter defenses and potentially exfiltrate data, scan internal networks for further vulnerabilities, or interact with backend systems that were intended to remain isolated from external traffic. The risk is particularly acute in cloud-native environments where private IP addresses are often used for inter-service communication, making the exposure of these endpoints a critical security incident. It is important to note that applications not utilizing images.remotePatterns are unaffected by this specific vector, as they do not engage in the same pattern-matching and subsequent DNS resolution workflow that exposes this logic error.
From a classification perspective, this vulnerability aligns with CWE-918, which addresses Server-Side Request Forgery (SSRF) flaws where server-side code makes requests to user-supplied URLs without proper validation of the resolved IP address. Furthermore, it maps to MITRE ATT&CK technique T1557, specifically Adversary-in-the-Middle or Lateral Movement via internal network probing, as the attacker uses the compromised application as a pivot point to access resources within the trusted network boundary. The core issue lies in the failure to enforce strict IP address validation after DNS resolution, allowing for domain hijacking techniques that exploit the trust relationship between the application and its configured remote patterns.
To mitigate this risk, organizations should immediately upgrade Next.js to version 16.3.8 or later, where the logic has been corrected to ensure that DNS resolutions are validated against private IP ranges after the initial URL pattern match. For administrators who cannot upgrade due to compatibility constraints or other operational reasons, a defensive audit of all images.remotePatterns configurations is essential. This involves reviewing allow-listed hosts and ensuring that no entries point to domains whose DNS records are not fully trusted or controlled by the organization. Additionally, implementing network-level controls such as egress filtering can provide an additional layer of defense by blocking outbound connections from application servers to private IP ranges, thereby neutralizing the impact even if the vulnerability is exploited. Regular monitoring of outbound traffic patterns and strict adherence to least-privilege principles for service accounts further reduce the attack surface associated with SSRF vulnerabilities in modern web frameworks.