CVE-2026-94483: Next.js has Server-Side Request Forgery in Image Optimization

October 7, 2026

An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization.

References

github.com/advisories/GHSA-cjq9-62q9-8jv4
github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b
github.com/vercel/next.js/releases/tag/v16.3.8
github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4
nvd.nist.gov/vuln/detail/CVE-2026-94483

Code Behaviors & Features

Detect and mitigate CVE-2026-94483 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →