CVE-2026-94483

Executive Summary

CVE-2026-94483 is a Server-Side Request Forgery (SSRF) vulnerability in Next.js Image Optimization affecting versions 16.0.0 through 16.3.7. The flaw allows an attacker-controlled DNS name that matches the images.remotePatterns allow-list to resolve to a private IP address after the allow-list check has passed, causing the image optimizer to fetch internal resources. Applications that do not configure images.remotePatterns are not affected. The issue is fixed in Next.js 16.3.8.

Technical Analysis

Next.js is a React framework for building full-stack web applications. It exposes an image optimization component that can fetch and transform remote images server-side rather than serving them directly to the browser. Administrators restrict the remote origins that may be fetched through the images.remotePatterns configuration. That configuration is an allow-list of host patterns against which a requested remote image URL is validated.

The vulnerability is a Time-of-Check-to-Time-of-Use (TOCTOU) weakness rooted in CWE-918 (Server-Side Request Forgery). The allow-list validation in affected versions evaluates the requested URL, and the request is permitted when the host matches an entry in images.remotePatterns. However, the optimized image fetch performs its own DNS resolution of that host name. Because the host name is attacker-controlled, the attacker can operate a DNS record that answers the allow-list check with a benign or expected value while later resolving (or being re-resolved) to a private IP address. The fetch then reaches private, internal, or link-local addresses that the allow-list was intended to keep out of reach.

The core defect is that the security decision is made against a name, while the actual connection is made to a resolved address, and the two are not bound to the same resolution. Next.js issues the outbound fetch to the resolved private IP even though the URL has already passed the allow-list gate. This is a classic DNS-rebinding / attacker-controlled-resolution SSRF pattern.

Only applications that configure images.remotePatterns with entries whose DNS records are not trusted are exposed. Deployments without images.remotePatterns do not invoke the gated remote fetch path and are not affected. There is no public proof-of-concept, exploit code, or Nuclei template available for this CVE, and the CVSS score has not been assigned by NVD. The description does not disclose further implementation internals such as specific function or parameter names beyond images.remotePatterns.

Exploitation Scenarios

No public proof of concept is available; the attack chain below is inferred from the SSRF vulnerability class and the behavior described in the advisory.

1. Reconnaissance / target identification. The attacker identifies a Next.js deployment (16.0.0 through 16.3.7) that uses the Image Optimization feature and has images.remotePatterns configured. Because remote image optimization is typically reachable through the public _next/image style endpoint, the attacker probes image requests to determine whether remote patterns are enforced, and enumerates candidate allow-listed host names or pattern entries.

2. Triggering the flaw class. The attacker submits an image optimization request referencing a remote URL whose host matches an entry in images.remotePatterns. The attacker controls the DNS record for that allowed host name. The allow-list check passes because the host name matches the configured pattern.

3. Resolution-based bypass (payload at the vulnerability-class level). The attacker configures the DNS for the allow-listed name so that the address the optimizer ultimately connects to is a private, internal, or link-local IP (for example, by changing the answer after the check or by serving a private address to the fetch step). Because the fetch performs its own DNS resolution after the allow-list check, the outbound connection reaches the private address. No specific payload syntax is documented, so no request parameters are fabricated here.

4. Post-exploitation impact. The optimizer acts as a server-side request proxy into the internal network. The attacker can reach services bound to private addresses — internal HTTP APIs, metadata endpoints, administrative interfaces, or other resources not otherwise exposed to the internet. Impact is limited to what the image fetch returns to the requester and to any state changed by reaching the internal endpoint; this is a confidentiality- and reachability-impacting SSRF rather than direct code execution.

Impact Assessment

The vulnerability enables server-side request forgery against internal network resources through a public-facing image optimization endpoint. Successful exploitation can expose internal services, retrieve data from private endpoints, and map internal network reachability, all with the privileges of the Next.js server process. Blast radius is bounded to deployments that configure images.remotePatterns with host entries whose DNS is not fully trusted; such environments may sit within cloud or on-prem networks where internal metadata services or administrative APIs are reachable from the application host.

Because NVD has not assigned a CVSS score for this CVE, no authoritative subscore breakdown is available. Based on the described behavior, the relevant characteristics are network attack vector, no required privileges, no user interaction, and scope change (the vulnerable component reaches resources beyond its intended authorization boundary), with confidentiality impact on internal resources. These factors should be confirmed against the vendor advisory once a score is published; the analyst should not treat the illustrative vector above as authoritative.

Detection Guidance

Sigma Rule

title: Next.js Image Optimization SSRF via Attacker-Controlled DNS Resolution
id: 8f2c1a44-7b3e-4d21-9a55-cve202694483
status: experimental
description: Detects image optimization requests routed to private or link-local
  IP space consistent with CVE-2026-94483 SSRF in Next.js Image Optimization.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94483
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: nextjs
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/_next/image'
  selection_output:
    cs-uri-query|contains:
      - 'url=http://10.'
      - 'url=http://127.'
      - 'url=http://169.254.'
      - 'url=http://172.16.'
      - 'url=http://192.168.'
      - 'url=https://10.'
      - 'url=https://127.'
      - 'url=https://169.254.'
      - 'url=https://192.168.'
  condition: selection_path and selection_output
falsepositives:
  - Internal tooling that legitimately proxies images from RFC1918 space
level: high
tags:
  - attack.t1190
  - cwe.918

YARA Rule

rule CVE_2026_94483_Nextjs_SSRF_RemotePatterns
{
    meta:
        description = "Detects Next.js image optimization requests targeting private address space indicative of CVE-2026-94483 SSRF"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94483"
        date = "2026-01-01"
        cve = "CVE-2026-94483"

    strings:
        $img = "/_next/image"
        $p1 = "url=http://127."
        $p2 = "url=http://169.254."
        $p3 = "url=http://10."
        $p4 = "url=http://192.168."
        $p5 = "url=http://172.16."
        $cfg = "images.remotePatterns"

    condition:
        any of ($img*) and 1 of ($p*) or $cfg
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94483 Next.js Image Optimization SSRF to Private IP"; flow:established,to_server; http.uri; content:"/_next/image"; http.uri; content:"url="; http.uri; pcre:"/url=https?:\/\/(127\.|10\.|169\.254\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/i"; reference:cve,CVE-2026-94483; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94483; classtype:web-application-attack; sid:202694483; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and
      url.path : "*/_next/image*" and
      url.query : "url=*" ]
  [ network where network.protocol == "http" and
      url.query regex "url=https?://(127\\.|10\\.|169\\.254\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.)" ]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*/_next/image*" AND uri_query="*url=*"
| regex uri_query="url=https?://(127\.|10\.|169\.254\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)"
| stats count min(_time) as first_seen max(_time) as last_seen
    by src_ip, uri_path, uri_query, status
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,nextjs,cve-2026-94483">
  <rule id="100483" level="12">
    <if_sid>31100</if_sid>
    <field name="url">/_next/image</field>
    <regex type="pcre2">url=https?:\/\/(127\.|10\.|169\.254\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)</regex>
    <description>CVE-2026-94483: Next.js Image Optimization SSRF attempt to private or link-local address</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,ssrf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The advisory states the issue is fixed in Next.js 16.3.8, but no patch source has been independently tracked.

1. Immediate mitigations

   • Audit every entry in images.remotePatterns. Remove or restrict entries whose DNS records are not fully trusted and controlled by your organization.
   • Do not allow-list host names that an external party can influence or whose DNS answers can be changed to private addresses.
   • Where remote image optimization is not required, disable the feature / avoid configuring images.remotePatterns; applications without this configuration are not affected.
   • Restrict egress from application hosts so that the Next.js server cannot reach private, loopback, link-local, or cloud metadata address ranges.

2. Patch / upgrade steps

   • Upgrade Next.js to version 16.3.8 or later, which the advisory states contains the fix.
   • After upgrading, verify image optimization still functions for intended allow-listed hosts.
   • Re-validate the images.remotePatterns configuration even after upgrading, since the allow-list remains the primary control.

3. Long-term hardening

   • Enforce a default-deny egress policy for application servers, permitting only required external destinations.
   • Resolve and pin allow-listed image hosts to expected addresses, and re-validate the resolved address against private ranges at fetch time where the framework permits.
   • Monitor /_next/image requests for private-address targets as a standing detection.
   • Track the Next.js advisory and re-confirm patch status; treat the 0/4 patch confidence as a signal that independent patch verification is still pending.

References

• NVD — CVE-2026-94483: https://nvd.nist.gov/vuln/detail/CVE-2026-94483
• Next.js project security/advisory channel (vendor security bulletins for the React framework)
• CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Next.js Image Optimization documentation (images.remotePatterns configuration)

No public proof-of-concept, Nuclei template, or exploit code is currently available for this CVE. There is no CISA KEV listing and no known threat actor campaign or exploit-in-the-wild evidence associated with CVE-2026-94483 at the time of writing.