https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-08T16:00:00.484735+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-94483 fkie_cve-2026-94483 2026-10-08T16:00:00.514979+00:00

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.

 https://db.gcve.eu/vuln/ghsa-cjq9-62q9-8jv4 GHSA-cjq9-62q9-8jv4 — Next.js has Server-Side Request Forgery in Image Optimization 2026-10-08T16:00:00.515071+00:00

Affected: npm: next

## Impact

An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization.

## Workaround

Audit allow-listed remote URLs in `images.remotePatterns` (see https://nextjs.org/docs/app/getting-started/images#remote-images) for hosts that may not be trusted with their DNS entries. If no `images.remotePatterns` are configured, your app is not affected.