{"schema":"threatline.record/2","record":{"id":"CVE-2026-94483","aliases":["GHSA-cjq9-62q9-8jv4"],"summary":"Next.js has Server-Side Request Forgery in Image Optimization","details":"## Impact\n\nAn attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization. \n\n## Workaround\n\nAudit allow-listed remote URLs in `images.remotePatterns` (see https://nextjs.org/docs/app/getting-started/images#remote-images) for hosts that may not be trusted with their DNS entries. If no `images.remotePatterns` are configured, your app is not affected.","categories":["Frameworks"],"product":"next","vendor":"vercel","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cjq9-62q9-8jv4","source_modified_at":"2026-10-07T20:30:56Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"next"},"range":">= 16.0.0, < 16.3.8"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-94483","source_modified_at":"2026-10-06T16:33:25.979Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"next.js","vendor":"vercel","versions":[{"version":">= 16.0.0, < 16.3.8","status":"affected"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4","source_modified_at":"2026-09-30T16:15:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"next"},"range":">= 16.0.0 < 16.3.?"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cjq9-62q9-8jv4","source_modified_at":"2026-10-07T20:45:06.190363835Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"next","purl":"pkg:npm/next"},"ranges":[{"events":[{"introduced":"16.0.0"},{"fixed":"16.3.8"}],"type":"SEMVER"}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cjq9-62q9-8jv4","source_modified_at":"2026-10-07T20:30:56Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"next"},"version":"16.3.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4","source_modified_at":"2026-09-30T16:15:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"next"},"version":"16.3.?"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cjq9-62q9-8jv4","source_modified_at":"2026-10-07T20:45:06.190363835Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"next","purl":"pkg:npm/next"},"version":"16.3.8"}],"cvss":8.3,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00244,"percentile":0.14747,"score_date":"2026-10-23"},"published_at":"2026-10-02T15:18:38.684Z","modified_at":"2026-10-07T20:45:06.190363835Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-cjq9-62q9-8jv4","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-07T20:30:56Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-94483","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-06T16:33:25.979Z"},{"source":"GitHub Advisory Database","url":"https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-30T16:15:36Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-cjq9-62q9-8jv4","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-07T20:45:06.190363835Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94483","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94483","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/vercel/next.js/releases/tag/v16.3.8","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-cjq9-62q9-8jv4","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-06T16:33:15.240863Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-07T20:45:06.190363835Z","content_hash":"0de1bba4a88a85b9435f63d049b14bd41cff66a0983c7898498d5f1ced959e6f"}}