https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T22:42:45.895971+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-382378 EUVD-2026-382378 2026-10-07T22:42:45.943072+00:00 EUVD-2026-382378 https://cve.radiocsirt.org/vuln/fkie_cve-2026-94483 fkie_cve-2026-94483 2026-10-07T22:42:45.943108+00:00

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.

 https://cve.radiocsirt.org/vuln/ghsa-cjq9-62q9-8jv4 GHSA-cjq9-62q9-8jv4 — Next.js has Server-Side Request Forgery in Image Optimization 2026-10-07T22:42:45.943142+00:00

Affected: npm: next

## Impact

An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization.

## Workaround

Audit allow-listed remote URLs in `images.remotePatterns` (see https://nextjs.org/docs/app/getting-started/images#remote-images) for hosts that may not be trusted with their DNS entries. If no `images.remotePatterns` are configured, your app is not affected.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3699 WID-SEC-W-2026-3699 — Vercel Next.js: Mehrere Schwachstellen 2026-10-07T22:42:45.943172+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder Denial-of-Service-Zustände auszulösen.