VDB
CVE-2026-94483
CVE-2026-94483
PUBLISHED
CVSS 8.3 HIGH
Reported by GitHub_M · Published October 2, 2026
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.
Risk Scores
CVSS 4.0
8.3
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| vercel | next.js | >= 16.0.0, < 16.3.8 |
| vercel | next.js | 16.0.0 |
| chainguard | zitadel-4 | 0 |
| npm | next | 16.0.0 |
| chainguard | langfuse-fips-4 | 0 |
Timeline
- Oct 2, 2026 Coalition ESS Score
- Oct 2, 2026 CVE Published
- Oct 3, 2026 EPSS Score
- Oct 6, 2026 EPSS Score
- Oct 7, 2026 CVE Updated
- Oct 10, 2026 EPSS Score
- Oct 14, 2026 EPSS Score
- Oct 19, 2026 EPSS Score
- Oct 23, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Oct 31, 2026 Security Advisory
References
- https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4 x_refsource_CONFIRM
- https://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b x_refsource_MISC
- https://github.com/vercel/next.js/releases/tag/v16.3.8 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-94483 advisory
- https://github.com/advisories/GHSA-cjq9-62q9-8jv4 advisory