Is CVE-2026-94483 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94483 being exploited in the wild.

How severe is CVE-2026-94483?

Medium severity, with a CVSS score of 6.5, published 2 October 2026.

Which products and versions are affected?

next (npm) >= 16.0.0, < 16.3.8, SEMVER:introduced=16.0.0,fixed=16.3.8; Vercel Next.js 16.0.0 through 16.3.7.

How is CVE-2026-94483 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-94483?

Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94483: Vercel Next.js Image Optimization DNS resolution bypass

Q: Is there a fix for CVE-2026-94483?

Yes. next (npm): upgrade to 16.3.8 or later. Until then: Administrators unable to upgrade should audit all allow-listed hosts in images.remotePatterns and remove any entries whose DNS records are not fully trusted or controlled by external parties. [{"kind":"disclosed","at":"2026-10-02"},{"kind":"patched","at":"2026-09-30"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-94483 · Severity: medium · CVSS 6.5 · Published 2026-10-02

Next.js is a popular React framework for building web applications. Its Image Optimization feature can be bypassed to reach private IP addresses on the server's network by exploiting DNS resolution timing, even when the requested domain is in the allow-list. An attacker can use this to access internal services and potentially leak sensitive data or internal application information.

Technologies: next (npm), Vercel Next.js. Vendors: npm, Vercel.

Quick answers

Is CVE-2026-94483 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94483 being exploited in the wild.
How severe is CVE-2026-94483?: Medium severity, with a CVSS score of 6.5, published 2 October 2026.
Which products and versions are affected?: next (npm) >= 16.0.0, < 16.3.8, SEMVER:introduced=16.0.0,fixed=16.3.8; Vercel Next.js 16.0.0 through 16.3.7.
Is there a fix for CVE-2026-94483?: Yes. next (npm): upgrade to 16.3.8 or later. Until then: Administrators unable to upgrade should audit all allow-listed hosts in images.remotePatterns and remove any entries whose DNS records are not fully trusted or controlled by external parties.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-02"},{"kind":"patched","at":"2026-09-30"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-94483 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-94483?: Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

next (npm): upgrade to 16.3.8 or later
```
npm install next@16.3.8
```

Administrators unable to upgrade should audit all allow-listed hosts in images.remotePatterns and remove any entries whose DNS records are not fully trusted or controlled by external parties.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-02"},{"kind":"patched","at":"2026-09-30"}]

Technical details

The vulnerability exists in Image Optimization when processing remote URLs matching images.remotePatterns. An attacker can craft a request with a domain that passes the URL allow-list check but resolves to a private IP address via DNS resolution timing tricks, causing the image fetch to reach internal IP addresses. This is a server-side request forgery (SSRF) variant that bypasses the intended remotePatterns validation. Applications without images.remotePatterns configured are not affected.

Affected products

Vercel Next.js 16.0.0 through 16.3.7

Identifiers

CVE-2026-94483
GHSA-cjq9-62q9-8jv4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.