CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
Attackers can exploit DNS rebinding in Next.js Image Optimization to access private network resources if remote image patterns are configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-94483?
CVE-2026-94483 is a high-severity server-side request forgery vulnerability in Vercel Next.js, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.
Weakness: CWE-918
Which versions are affected by CVE-2026-94483?
2 open source packages ship an affected version, including next. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
next npm | From 16.0.0 | 16.3.8 |
next npm | From 16.0.0 | 16.3.8 |
Products include Vercel Next.js.
How do I fix CVE-2026-94483?
Upgrade next to 16.3.8 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-94483 being exploited?
There is no known exploitation of CVE-2026-94483 in the wild and no public exploit code.
Other vulnerabilities in Vercel Next.js
- CVE-2025-29927 Authorization Bypass in Next.js Middleware
- CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgrades
- CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
- CVE-2026-64649 Next.js: Server-Side Request Forgery in Server Actions on Custom Servers
Sources
Also known as CLEANSTART-2026-CR16347, CLEANSTART-2026-JD47391, CLEANSTART-2026-WN21226, ECHO-7713-e30d-2172, GHSA-cjq9-62q9-8jv4, MINI-h5wq-85mw-5xhp and 3 more.