Next.jsにサーバーサイドリクエストフォージェリ（SSRF）の脆弱性（CVE-2026-94483）
概要
Next.jsにサーバーサイドリクエストフォージェリ（SSRF）の脆弱性が確認されました。
バージョン 16.0.0 以上 16.3.8 未満に影響があります。
修正版 16.3.8 への更新が推奨されます。
脆弱性の基本情報
| 脆弱性ID |
CVE-2026-94483 GHSA-cjq9-62q9-8jv4 |
|---|---|
| 脆弱性の種類 | サーバーサイドリクエストフォージェリ（SSRF） |
| 危険度 | 高 |
| CVSSスコア |
8.3（CVSS v4.0） CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
| 公開日 | 2026年10月7日 |
影響を受ける製品
| 製品 | 影響を受けるバージョン | 修正版 | 出典 |
|---|---|---|---|
| Next.js |
16.0.0 以上 16.3.8 未満 | 16.3.8 | OSV.dev |
推奨対応
- Next.jsを修正版 16.3.8 またはそれ以降の公式最新版へ更新してください。
情報元の原文
OSV.dev
Next.js has Server-Side Request Forgery in Image Optimization
## Impact
An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization.
## Workaround
Audit allow-listed remote URLs in `images.remotePatterns` (see https://nextjs.org/docs/app/getting-started/images#remote-images) for hosts that may not be trusted with their DNS entries. If no `images.remotePatterns` are configured, your app is not affected.
利用条件：CC BY 4.0
出典: GitHub Advisory Database（OSV.dev 経由で取得）。原文のまま掲載（改変なし）
NVD（National Vulnerability Database / NIST）
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.
利用条件：米国政府の著作物（パブリックドメイン）・原文のまま掲載
Copyright 1999-2026 The MITRE Corporation
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
CVE List（CVE Program）
Next.js: Server-Side Request Forgery in Image Optimization
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.
利用条件：CVE の利用条件（CVE Terms of Use）・原文のまま掲載
Copyright 1999-2026 The MITRE Corporation
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
情報元
- OSV.dev
https://github.com/advisories/GHSA-cjq9-62q9-8jv4 - NVD（National Vulnerability Database / NIST）
https://nvd.nist.gov/vuln/detail/CVE-2026-94483 - CVE List（CVE Program）
https://www.cve.org/CVERecord?id=CVE-2026-94483