{"id":"EUVD-2026-91671","enisaUuid":"e99619d0-3904-3e79-8df9-ffdc0377d777","description":"Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.","datePublished":"Oct 2, 2026, 3:18:38 PM","dateUpdated":"Oct 6, 2026, 4:33:25 PM","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4\nhttps://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b\nhttps://github.com/vercel/next.js/releases/tag/v16.3.8\n","aliases":"CVE-2026-94483\nGHSA-cjq9-62q9-8jv4\n","assigner":"GitHub_M","epss":0.33,"enisaIdProduct":[{"id":"160339bc-9844-3bbb-bd74-6b1d64d0aa16","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"16.0.0, \u003c 16.3.8"}],"enisaIdVendor":[{"id":"a2f705c8-c052-3380-86d1-3280c414bbed","vendor":{"name":"vercel"}}],"enisaIdVulnerability":[{"id":"0b4013fe-be4c-30d7-986f-8c0d39cf07ad","vulnerability":{"id":"GHSA-cjq9-62q9-8jv4","description":"Next.js has Server-Side Request Forgery in Image Optimization","datePublished":"Oct 7, 2026, 8:30:55 PM","dateUpdated":"Oct 7, 2026, 8:30:55 PM","baseScore":0.0,"references":"https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-94483\nhttps://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b\nhttps://github.com/vercel/next.js\nhttps://github.com/vercel/next.js/releases/tag/v16.3.8\n","enisa_id":"EUVD-2026-91671\n","aliases":"CVE-2026-94483\nGHSA-cjq9-62q9-8jv4\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"939f2523-3488-3bc7-8812-4519e649aaba","vulnerability":{"id":"CVE-2026-94483","description":"Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.","datePublished":"Oct 2, 2026, 3:18:38 PM","dateUpdated":"Oct 6, 2026, 4:33:25 PM","status":"PUBLISHED","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4\nhttps://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b\nhttps://github.com/vercel/next.js/releases/tag/v16.3.8\n","enisa_id":"EUVD-2026-91671\n","assigner":"GitHub_M","epss":0.33,"dataProcessed":"Oct 28, 2026, 7:19:29 AM","vulnerabilityProduct":[{"id":"93a3b2f5-fb2f-3707-bd5a-9aace23baa01","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"16.0.0, \u003c 16.3.8"}],"vulnerabilityVendor":[{"id":"6d7083f9-f34e-3845-9854-d68882921f3b","vendor":{"name":"vercel"}}]}}],"enisaIdAdvisory":[]}