Fluid Attacks Database

Description

Next.js has Server-Side Request Forgery in Image Optimization

Impact

An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization.

Workaround

Audit allow-listed remote URLs in images.remotePatterns (see https://nextjs.org/docs/app/getting-started/images#remote-images) for hosts that may not be trusted with their DNS entries. If no images.remotePatterns are configured, your app is not affected.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel7	firefox	-	-
rpm rhel8	firefox	-	-
rpm rhel9	firefox	-	-
rpm rhel10	thunderbird	-	-
rpm rhel8	thunderbird	-	-
rpm rhel9	thunderbird	-	-
rpm rhel10	firefox	-	-
npm	next	>=16.0.0 <16.3.8	16.3.8

Aliases

1. CVE-2026-944832. NVD-2026-944833. OSV-2026-944834. GHSA-cjq9-62q9-8jv45. GCVE-2026-94483

References

1. https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv42. https://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b3. https://github.com/vercel/next.js/releases/tag/v16.3.8

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.