CVE-2026-94483

A flaw was found in Next.js Image Optimization, which can lead to information disclosure via Server-Side Request Forgery (SSRF). In configurations where remote image optimization is enabled with host allowlists, the application can follow attacker-controlled Domain Name System (DNS) resolution after initial URL validation checks. A remote attacker can exploit this flaw to bypass network restrictions and force the server to query private IP addresses, exposing sensitive internal services.

This vulnerability is rated with a Low severity because exploitation requires a specific, non-default configuration where the application explicitly permits remote domains whose DNS records can be controlled or manipulated by an external adversary. In typical Red Hat deployments, Next.js is not exposed with arbitrary remote image patterns permitted, which significantly restricts the attack surface. Furthermore, successful abuse is limited to internal network request forgery with read-only retrieval of image responses, without direct code execution or write privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Audit and restrict the images.remotePatterns configuration in next.config.js to eliminate untrusted hostnames, or remove the remotePatterns configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.

Caveats: Disabling or removing remote image entries will prevent external image optimization.

Warning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability.