Next.js: Server-Side Request Forgery in Image Optimization
Summary
Next.js Image Optimization in versions 16.0.0 up to 16.3.7 can be tricked into fetching a remote image from a private IP address. An attacker who controls DNS for a host on the images.remotePatterns allow-list can make the server request internal resources after the URL passes the check. Applications without images.remotePatterns are not affected.
Affected
- Next.js (npm package next) from 16.0.0 before 16.3.8
- Applications that configure images.remotePatterns
- Next.js 15.x is not affected by this CVE
Fixed in
- Upgrade to Next.js 16.3.8 or later (released 2026-09-30)
Workaround
- Audit the hosts in images.remotePatterns and remove entries whose DNS records are not trusted
- If no images.remotePatterns are configured, the application is not affected
- No other vendor-documented mitigation is known; upgrading is the complete fix
Exploitation
- No in-the-wild exploitation known at the time of writing
- Not listed in CISA SSVC as automatable (Automatable: no)
- Public proof of concept: unknown; verify against CISA KEV and exploit databases
Our recommendation
- Check whether Next.js 16.x applications are in use and whether images.remotePatterns is configured
- Upgrade to Next.js 16.3.8 or later
- If an upgrade is not possible, remove remote patterns for untrusted hosts
- Review which internal services the application server can reach, and restrict outbound access from the web server where possible
- Monitor logs for unusual Image Optimization requests
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-cjq9-62q9-8jv4 github.com
- Next.js Release v16.3.8 github.com
- Fix commit e002ad6 github.com
- Next.js September 2026 security release nextjs.org
- OSV GHSA-cjq9-62q9-8jv4 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:16.
Original description (NVD)
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.