Seven vulnerabilities, one patch, and a single number stands out: CVE-2026-94483. If your next.config uses the images.remotePatterns option, you may have been running an open door into private cloud infrastructure for months without knowing it. On September 30, 2026, the Next.js team closed this security hole with versions 16.3.8 and 15.5.27. For production Node.js environments, this is not an optional update — it’s an urgent requirement.
This article explains exactly what happened, who is affected, and how development teams can close the gap quickly and safely.
Table of Contents
Key Takeaways
- CVE-2026-94483 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in Next.js Image Optimization.
- Affected are Next.js versions >=16.0.0 <16.3.8 and 15.5.x before 15.5.27, but only when
images.remotePatternsis configured. - Attackers can use DNS manipulation of an allowed host to force the server to send requests to private IP ranges, such as cloud metadata services.
- The fix is a simple update to next@16.3.8 or next@15.5.27; a workaround without updating is to remove untrusted hosts from
remotePatterns. - The release fixes seven vulnerabilities in total, including cache poisoning, draft-mode leaks, and an info disclosure in the dev server.
What exactly is CVE-2026-94483?
CVE-2026-94483 affects Next.js’s built-in Image Optimization feature, which loads, transforms, and serves images from external sources. This feature has long been popular because it automatically optimizes formats, resizes images, and reduces load times. That convenience is now the risk.
Also relevant is the article MariaDB SQL Injection: Critical Flaws in MariaDB Connector/Node.js Patched, which covers similar CVE patch mechanisms in the Node.js ecosystem.The vulnerability falls into the Server-Side Request Forgery (SSRF) category. An attacker forces the server to send network requests to targets that should normally be unreachable, such as internal admin panels or cloud metadata services like AWS EC2 Instance Metadata or the Google Cloud Metadata Server. These services often return sensitive information, such as temporary access credentials, when queried directly.
The role of images.remotePatterns
This Next.js security vulnerability only becomes relevant when developers use the images.remotePatterns option in their next.config.js or next.config.ts. This setting allows certain external domains to be defined as trusted image sources — for example, a CDN or an image hosting service.
The problem: Next.js checks the hostname against the allowed list when loading an image, but the actual network request happens afterward, based on the IP address resolved at that point in time. That’s exactly where the attack comes in.
“A configuration meant to create security is turned into its opposite through DNS manipulation.”
How the attack works (DNS rebinding)
The attack path can be described in simple steps:
- An attacker controls a host that is listed as trusted in
images.remotePatterns, or uses a domain with a very short DNS TTL. - At the moment Next.js checks the hostname, the domain resolves to a legitimate, allowed IP address.
- Immediately afterward, the attacker changes the DNS record so that the same hostname now points to a private IP address, such as
169.254.169.254, the classic address for cloud metadata services. - Next.js sends the actual image request to this new, private address, because validation was already completed.
- The server may return internal data that the attacker can extract from the image response or error messages.
This technique is known as DNS rebinding and is frequently used to exploit validation gaps in hostname-based security checks.
Who is affected by this Next.js security vulnerability?
The affected version ranges are clearly defined:
| Next.js line | Affected versions | Patched version |
|---|---|---|
| Active LTS (16.x) | >=16.0.0 <16.3.8 | 16.3.8 |
| Maintenance LTS (15.x) | 15.5.x before 15.5.27 | 15.5.27 |
However, one additional condition is decisive: only applications that have images.remotePatterns configured in next.config are actually exploitable. Projects that use the Next.js Image component exclusively with local images, or without this configuration option, are not affected by CVE-2026-94483.
In practice, this means: content management systems, marketplaces, blogs with an external image CDN, or e-commerce platforms that embed third-party product images carry significantly higher risk than plain landing pages without external image sources.
Risk assessment for production systems
The High Severity rating is justified because the consequences can extend far beyond the application itself. If a cloud metadata service is successfully reached, attackers may obtain temporary IAM credentials. Those credentials can in turn be used to access other cloud resources — databases, storage buckets, or internal APIs.
For teams running Next.js on AWS, Google Cloud, or Azure with instance roles that carry broad permissions, the risk is particularly high.
The six other vulnerabilities at a glance
The security update from September 30, 2026 fixes not only the SSRF flaw, but seven issues in total. An overview:
- CVE-2026-94543 (Medium): Cache poisoning of statically generated (SSG) and incrementally regenerated (ISR) pages. Affects exclusively self-hosted deployments. Vercel-hosted applications are explicitly not affected.
- Two ‘use cache’ leaks: Bugs in Next.js’s newer caching primitive. One of the two flaws can cause content from Draft Mode to be unintentionally exposed — relevant for editorial systems with a preview feature.
- Metadata image route vulnerability: Affects builds created with Webpack. Projects already using Turbopack as their build tool are not affected.
- CVE-2026-94486 (Low): An information disclosure vulnerability via the MCP endpoint of the next-dev server. This affects exclusively local development environments, not production systems.
Even though CVE-2026-94483 is at the center of the coverage, it’s worth reviewing the full list. Teams with self-hosted infrastructure or active Draft Mode in particular should not ignore the additional items.
How developers close this Next.js security vulnerability
Fixing this Next.js security vulnerability requires, in most cases, just a single command. Next.js follows its usual patch model: an update to the current patch version within the existing major line.
Step 1: Check the version
First, determine the currently installed version:
npm list next
Step 2: Update to the patched version
Depending on which line you use, run:
npm install [email protected]or, for projects on the Maintenance LTS line:
npm install [email protected]After installation, a full rebuild and a run of the existing test suite are recommended, especially for areas that use the Image component, ISR pages, or Draft Mode.
Step 3: Workaround if an immediate update isn’t possible
Not every team can update a production system within hours, for example due to approval processes or change-management requirements. For that case, there’s a short-term workaround:
Remove all non-essential or not-fully-trusted hosts from images.remotePatterns. The narrower this list, the smaller the attack surface. Ideally, only domains operated by your own company or by well-established, known CDN providers with stable infrastructure should remain listed.
This workaround does not replace the update, but it reduces the immediate risk until the full patch can be rolled out.
Remediation checklist
- Identify the installed Next.js version
- Check whether
images.remotePatternsis used in the configuration - Update to 16.3.8 or 15.5.27
- For self-hosted deployments, also review cache behavior after the update
- Audit Draft Mode access and permissions
- Check your build tool (Webpack vs. Turbopack) regarding the metadata image route flaw
- Update local development environments as well
Why this Next.js security vulnerability matters beyond this one case
SSRF vulnerabilities have been among the most frequently exploited weaknesses in cloud-native applications for years. OWASP explicitly lists SSRF as its own category in its Top 10 risks for web applications. The reason: modern frameworks increasingly offer built-in features that fetch external resources server-side — images, webhooks, API proxies. Each of these features is a potential attack vector if validation is not enforced consistently across the entire request lifecycle.
With its Image Optimization feature, Next.js is one of the most widely used React frameworks in existence. A vulnerability in this central building block potentially affects thousands of production applications worldwide, from small startup projects to enterprise platforms.
Teams should also take this incident as an opportunity to review general SSRF protections: network segmentation, restrictive IAM roles for cloud instances, and consistently blocking access to metadata endpoints from application servers wherever technically possible.
Frequently asked questions about the Next.js security vulnerability
Is my application affected if I don’t embed external images?
No. Without a configured images.remotePatterns, there is, according to the official statement, no attack surface for CVE-2026-94483.
Is a simple npm update enough? In the vast majority of cases, yes. Next.js follows semantic versioning at the patch level, so no breaking changes are expected.
Does the cache poisoning flaw also affect Vercel hosting? No, CVE-2026-94543 affects exclusively self-hosted deployments, according to the advisory.
Conclusion and next steps
The Next.js security vulnerability CVE-2026-94483 shows clearly how a convenient default feature can turn into a serious security risk once external network requests come into play. For teams with images.remotePatterns configured, action is required, not optional.
Specifically, development teams should now:
- Check all production Next.js deployments for their version number.
- Update immediately to 16.3.8 or 15.5.27.
- If an immediate update isn’t possible, consistently trim the list of allowed hosts in
images.remotePatterns. - Assess the other six fixed vulnerabilities in your own deployment context, especially for self-hosted infrastructure and active Draft Mode.
- Establish long-term SSRF protections at the infrastructure level, such as network rules that block access to cloud metadata services from application servers.
Teams that implement these steps promptly not only close an acute gap, but fundamentally strengthen their infrastructure’s resilience against future SSRF-based attacks.
