CVE-2026-94483

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-94483
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94483.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-94483
Aliases
  • GHSA-cjq9-62q9-8jv4
Published
2026-10-02T15:18:38Z
Modified
2026-10-04T02:47:15Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Next.js: Server-Side Request Forgery in Image Optimization
Details

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94483.json"
}
References

Affected packages

Git / github.com/vercel/next.js

Affected ranges

Type
GIT
Repo
https://github.com/vercel/next.js
Events
Introduced
950609f96f694c5475d18cd2d72a0052ca04d4b9
Fixed
e002ad68bd676bb0ed0c87bb22e3590304763e0b
Fixed
b0fad0d45eb4c4430fda5eeeb442e8a5af08a5f6
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "16.0.0"
        },
        {
            "fixed":  "16.3.8"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v16.*
v16.0.0
v16.0.1
v16.0.1-canary.0
v16.0.1-canary.1
v16.0.1-canary.2
v16.0.1-canary.3
v16.0.1-canary.4
v16.0.1-canary.5
v16.0.1-canary.6
v16.0.2-canary.0
v16.0.2-canary.1
v16.0.2-canary.10
v16.0.2-canary.11
v16.0.2-canary.12
v16.0.2-canary.13
v16.0.2-canary.14
v16.0.2-canary.15
v16.0.2-canary.16
v16.0.2-canary.17
v16.0.2-canary.18
v16.0.2-canary.19
v16.0.2-canary.2
v16.0.2-canary.20
v16.0.2-canary.21
v16.0.2-canary.22
v16.0.2-canary.23
v16.0.2-canary.24
v16.0.2-canary.25
v16.0.2-canary.26
v16.0.2-canary.27
v16.0.2-canary.28
v16.0.2-canary.29
v16.0.2-canary.3
v16.0.2-canary.30
v16.0.2-canary.31
v16.0.2-canary.32
v16.0.2-canary.33
v16.0.2-canary.34
v16.0.2-canary.4
v16.0.2-canary.5
v16.0.2-canary.6
v16.0.2-canary.7
v16.0.2-canary.8
v16.0.2-canary.9
v16.1.0
v16.1.0-canary.0
v16.1.0-canary.1
v16.1.0-canary.10
v16.1.0-canary.11
v16.1.0-canary.12
v16.1.0-canary.13
v16.1.0-canary.14
v16.1.0-canary.15
v16.1.0-canary.16
v16.1.0-canary.17
v16.1.0-canary.18
v16.1.0-canary.19
v16.1.0-canary.2
v16.1.0-canary.20
v16.1.0-canary.21
v16.1.0-canary.22
v16.1.0-canary.23
v16.1.0-canary.24
v16.1.0-canary.25
v16.1.0-canary.26
v16.1.0-canary.27
v16.1.0-canary.28
v16.1.0-canary.29
v16.1.0-canary.3
v16.1.0-canary.30
v16.1.0-canary.31
v16.1.0-canary.32
v16.1.0-canary.33
v16.1.0-canary.34
v16.1.0-canary.4
v16.1.0-canary.5
v16.1.0-canary.6
v16.1.0-canary.7
v16.1.0-canary.8
v16.1.0-canary.9
v16.1.1-canary.0
v16.1.1-canary.1
v16.1.1-canary.10
v16.1.1-canary.11
v16.1.1-canary.12
v16.1.1-canary.13
v16.1.1-canary.14
v16.1.1-canary.15
v16.1.1-canary.16
v16.1.1-canary.17
v16.1.1-canary.18
v16.1.1-canary.19
v16.1.1-canary.2
v16.1.1-canary.20
v16.1.1-canary.21
v16.1.1-canary.22
v16.1.1-canary.23
v16.1.1-canary.24
v16.1.1-canary.25
v16.1.1-canary.26
v16.1.1-canary.27
v16.1.1-canary.28
v16.1.1-canary.29
v16.1.1-canary.3
v16.1.1-canary.30
v16.1.1-canary.31
v16.1.1-canary.32
v16.1.1-canary.33
v16.1.1-canary.34
v16.1.1-canary.35
v16.1.1-canary.36
v16.1.1-canary.4
v16.1.1-canary.5
v16.1.1-canary.6
v16.1.1-canary.7
v16.1.1-canary.8
v16.1.1-canary.9
v16.2.0
v16.2.0-canary.0
v16.2.0-canary.1
v16.2.0-canary.10
v16.2.0-canary.100
v16.2.0-canary.101
v16.2.0-canary.102
v16.2.0-canary.103
v16.2.0-canary.104
v16.2.0-canary.11
v16.2.0-canary.12
v16.2.0-canary.13
v16.2.0-canary.14
v16.2.0-canary.15
v16.2.0-canary.16
v16.2.0-canary.17
v16.2.0-canary.18
v16.2.0-canary.19
v16.2.0-canary.2
v16.2.0-canary.20
v16.2.0-canary.21
v16.2.0-canary.22
v16.2.0-canary.23
v16.2.0-canary.24
v16.2.0-canary.25
v16.2.0-canary.26
v16.2.0-canary.27
v16.2.0-canary.28
v16.2.0-canary.29
v16.2.0-canary.3
v16.2.0-canary.30
v16.2.0-canary.31
v16.2.0-canary.32
v16.2.0-canary.33
v16.2.0-canary.34
v16.2.0-canary.35
v16.2.0-canary.36
v16.2.0-canary.37
v16.2.0-canary.38
v16.2.0-canary.39
v16.2.0-canary.4
v16.2.0-canary.40
v16.2.0-canary.41
v16.2.0-canary.42
v16.2.0-canary.43
v16.2.0-canary.44
v16.2.0-canary.45
v16.2.0-canary.46
v16.2.0-canary.47
v16.2.0-canary.48
v16.2.0-canary.49
v16.2.0-canary.5
v16.2.0-canary.50
v16.2.0-canary.51
v16.2.0-canary.52
v16.2.0-canary.53
v16.2.0-canary.54
v16.2.0-canary.55
v16.2.0-canary.56
v16.2.0-canary.57
v16.2.0-canary.58
v16.2.0-canary.59
v16.2.0-canary.6
v16.2.0-canary.60
v16.2.0-canary.61
v16.2.0-canary.62
v16.2.0-canary.63
v16.2.0-canary.64
v16.2.0-canary.65
v16.2.0-canary.66
v16.2.0-canary.67
v16.2.0-canary.68
v16.2.0-canary.69
v16.2.0-canary.7
v16.2.0-canary.70
v16.2.0-canary.71
v16.2.0-canary.72
v16.2.0-canary.73
v16.2.0-canary.74
v16.2.0-canary.75
v16.2.0-canary.76
v16.2.0-canary.77
v16.2.0-canary.78
v16.2.0-canary.79
v16.2.0-canary.8
v16.2.0-canary.80
v16.2.0-canary.81
v16.2.0-canary.82
v16.2.0-canary.83
v16.2.0-canary.84
v16.2.0-canary.85
v16.2.0-canary.86
v16.2.0-canary.87
v16.2.0-canary.88
v16.2.0-canary.89
v16.2.0-canary.9
v16.2.0-canary.90
v16.2.0-canary.91
v16.2.0-canary.92
v16.2.0-canary.93
v16.2.0-canary.94
v16.2.0-canary.95
v16.2.0-canary.96
v16.2.0-canary.97
v16.2.0-canary.98
v16.2.0-canary.99
v16.2.1-canary.0
v16.2.1-canary.1
v16.2.1-canary.10
v16.2.1-canary.11
v16.2.1-canary.12
v16.2.1-canary.13
v16.2.1-canary.14
v16.2.1-canary.15
v16.2.1-canary.16
v16.2.1-canary.17
v16.2.1-canary.18
v16.2.1-canary.19
v16.2.1-canary.2
v16.2.1-canary.20
v16.2.1-canary.21
v16.2.1-canary.22
v16.2.1-canary.23
v16.2.1-canary.24
v16.2.1-canary.25
v16.2.1-canary.26
v16.2.1-canary.27
v16.2.1-canary.28
v16.2.1-canary.29
v16.2.1-canary.3
v16.2.1-canary.30
v16.2.1-canary.31
v16.2.1-canary.32
v16.2.1-canary.33
v16.2.1-canary.34
v16.2.1-canary.35
v16.2.1-canary.36
v16.2.1-canary.37
v16.2.1-canary.38
v16.2.1-canary.39
v16.2.1-canary.4
v16.2.1-canary.40
v16.2.1-canary.41
v16.2.1-canary.42
v16.2.1-canary.43
v16.2.1-canary.44
v16.2.1-canary.45
v16.2.1-canary.46
v16.2.1-canary.5
v16.2.1-canary.6
v16.2.1-canary.7
v16.2.1-canary.8
v16.2.1-canary.9
v16.3.0
v16.3.0-canary.0
v16.3.0-canary.1
v16.3.0-canary.10
v16.3.0-canary.100
v16.3.0-canary.101
v16.3.0-canary.102
v16.3.0-canary.103
v16.3.0-canary.104
v16.3.0-canary.105
v16.3.0-canary.106
v16.3.0-canary.107
v16.3.0-canary.11
v16.3.0-canary.12
v16.3.0-canary.13
v16.3.0-canary.14
v16.3.0-canary.15
v16.3.0-canary.16
v16.3.0-canary.17
v16.3.0-canary.18
v16.3.0-canary.19
v16.3.0-canary.2
v16.3.0-canary.20
v16.3.0-canary.21
v16.3.0-canary.22
v16.3.0-canary.23
v16.3.0-canary.24
v16.3.0-canary.25
v16.3.0-canary.26
v16.3.0-canary.27
v16.3.0-canary.28
v16.3.0-canary.29
v16.3.0-canary.3
v16.3.0-canary.30
v16.3.0-canary.31
v16.3.0-canary.32
v16.3.0-canary.33
v16.3.0-canary.34
v16.3.0-canary.35
v16.3.0-canary.36
v16.3.0-canary.37
v16.3.0-canary.38
v16.3.0-canary.39
v16.3.0-canary.4
v16.3.0-canary.40
v16.3.0-canary.41
v16.3.0-canary.42
v16.3.0-canary.43
v16.3.0-canary.44
v16.3.0-canary.45
v16.3.0-canary.46
v16.3.0-canary.47
v16.3.0-canary.48
v16.3.0-canary.49
v16.3.0-canary.5
v16.3.0-canary.50
v16.3.0-canary.51
v16.3.0-canary.52
v16.3.0-canary.53
v16.3.0-canary.54
v16.3.0-canary.55
v16.3.0-canary.56
v16.3.0-canary.57
v16.3.0-canary.58
v16.3.0-canary.59
v16.3.0-canary.6
v16.3.0-canary.60
v16.3.0-canary.61
v16.3.0-canary.62
v16.3.0-canary.63
v16.3.0-canary.64
v16.3.0-canary.65
v16.3.0-canary.66
v16.3.0-canary.67
v16.3.0-canary.68
v16.3.0-canary.69
v16.3.0-canary.7
v16.3.0-canary.70
v16.3.0-canary.71
v16.3.0-canary.72
v16.3.0-canary.73
v16.3.0-canary.74
v16.3.0-canary.75
v16.3.0-canary.76
v16.3.0-canary.77
v16.3.0-canary.78
v16.3.0-canary.79
v16.3.0-canary.8
v16.3.0-canary.80
v16.3.0-canary.81
v16.3.0-canary.82
v16.3.0-canary.83
v16.3.0-canary.84
v16.3.0-canary.85
v16.3.0-canary.86
v16.3.0-canary.87
v16.3.0-canary.88
v16.3.0-canary.89
v16.3.0-canary.9
v16.3.0-canary.90
v16.3.0-canary.91
v16.3.0-canary.92
v16.3.0-canary.93
v16.3.0-canary.94
v16.3.0-canary.95
v16.3.0-canary.96
v16.3.0-canary.97
v16.3.0-canary.98
v16.3.0-canary.99
v16.3.0-preview.10
v16.3.0-preview.4
v16.3.0-preview.5
v16.3.0-preview.6
v16.3.0-preview.7
v16.3.0-preview.8
v16.3.0-preview.9
v16.3.1
v16.3.2
v16.3.3
v16.3.4
v16.3.5
v16.3.6
v16.3.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94483.json"