CyberRota Analysis
AI-GeneratedNext.js versions 16.0.0 to 16.3.8 are vulnerable due to a flaw in the Image Optimization feature, which can be manipulated to resolve attacker-controlled DNS for remote URLs, potentially exposing private IP addresses. This poses a significant risk for applications that utilize the images.remotePatterns configuration. Developers and system administrators using these versions should prioritize upgrading to 16.3.8 or later, or alternatively, audit their allow-listed hosts to ensure DNS records are from trusted sources.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.
Related CVEs
Other vulnerabilities affecting the same vendor(s)