Astro - Unauthorized Third-Party Image Access

Astro 5.13.2 and 4.16.18 contains an information disclosure vulnerability caused by improper validation of protocol-relative URLs in the image optimization endpoint, letting attackers serve images from unauthorized third-party domains, exploit requires on-demand rendering deployment. id:...

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution RCE when Next.js runs on glibc-based Linux. Workaround Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh...

npm: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

npm: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used vulnerability discovered by ? in WordPress npm next versions = 10.0.0, = 15.5.27...

Next.js 16.4.0 Image Optimization Remote Code Execution

Next.js versions through 15.5.27 and 16.0.1 through 16.4.0 contain an unauthenticated remote code execution vulnerability in Image Optimization when crafted SVG content is processed by vulnerable sharp and librsvg builds. https://packetstorm.news/download/236044...

NPM: Next.js has Server-Side Request Forgery in Image Optimization

NPM: Next.js has Server-Side Request Forgery in Image Optimization vulnerability discovered by ? in WordPress Npm next versions = 16.0.0, 16.3.8...

EUVD-2026-91671

Next.js has Server-Side Request Forgery in Image Optimization...

Next.js has Server-Side Request Forgery in Image Optimization

Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery e.g. to private IPs during Image Optimization. Workaround Audit allow-listed remote URLs in images.remotePatterns see https://nextjs.org/docs/app/getting-started/imagesremote-images for hosts that may n...

GHSA-CJQ9-62Q9-8JV4 Next.js has Server-Side Request Forgery in Image Optimization

Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery e.g. to private IPs during Image Optimization. Workaround Audit allow-listed remote URLs in images.remotePatterns see https://nextjs.org/docs/app/getting-started/imagesremote-images for hosts that may n...

CVE-2026-94483

A flaw was found in Next.js Image Optimization, which can lead to information disclosure via Server-Side Request Forgery SSRF. In configurations where remote image optimization is enabled with host allowlists, the application can follow attacker-controlled Domain Name System DNS resolution after...

CVE-2026-94483

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL...

CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL...

CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL...

CVE-2026-94483

The Next.js React framework (versions 16.0.0 through 16.3.8 ) contains a Server-Side Request Forgery (SSRF) vulnerability within the Image Optimization component. The root cause is that the framework can follow attacker-controlled DNS resolution for remote URLs that match images.remotePatterns. T...

CVE-2026-94483

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL...

CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL...

PT-2026-104375

Name of the Vulnerable Software and Affected Versions Next.js versions 16.0.0 through 16.3.7 Description Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns. This allows the optimized image fetch to reach private IP addresses after...

Linux Distros Unpatched Vulnerability : CVE-2026-94483

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolutio...

CVE-2026-94483: Server-Side Request Forgery (SSRF)

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL...

Server-side Request Forgery (SSRF)

Overview next is a react framework. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the Image Optimization remote fetch, which resolves and requests an allowlisted remote URL without constraining the address that name resolves to, so a host permitted by...

CVE-2026-84904

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing...