Next.js EUVD-2026-91671

Exploitation requires the target application to have images.remotePatterns configured (applications without it are explicitly not affected) AND an attacker-influenceable DNS resolution for a host that passes that allow-list - either an allow-listed host whose DNS records are not trusted, or an attacker-controlled host matching a pattern on which DNS rebinding can be performed. Limiting factors: the attacker must win the timing window between the allow-list check and the socket's independent DNS lookup (reflected by AC:H/AT:P), so this is a race condition rather than a deterministic single-request exploit; no authentication or user interaction is required (PR:N/UI:N). Fixed by pinning the connection to the already-validated addresses in 16.3.8.

This is a genuine but conditionally-gated SSRF (CWE-918). The provided CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) and 8.3 HIGH score describe an unauthenticated, network-reachable attack, but the elevated attack complexity (AC:H) and attack requirements (AT:P) correctly reflect that successful exploitation depends on winning a DNS resolution race (TOCTOU between the allow-list check and the socket's own lookup - classic DNS rebinding). No EPSS score, KEV listing, or POC was supplied in the input, so exploitation probability cannot be quantified from the data; based on signals present this is no public exploit identified at time of analysis. The real-world risk is tightly scoped: the vendor advisory and description both state applications without images.remotePatterns are not affected, so this is NOT a blanket risk to all Next.js deployments despite the framework's huge footprint. Impact is primarily confidentiality (VC:H - reaching internal services and cloud metadata endpoints) with limited integrity (VI:L) and no availability impact. Priority should be HIGH for environments that use remote image optimization with allow-listed hosts whose DNS records are not fully trusted, and LOW for the many deployments that do not configure remotePatterns. No conflicting signals in the data itself; the main gap is the absence of exploitation-probability telemetry (EPSS/KEV/POC not provided).

An attacker registers or controls a hostname that matches an entry in the victim application's images.remotePatterns allow-list (or influences DNS for an already-allow-listed host). During the allow-list validation the hostname resolves to a benign public IP, but by the time the optimizer's socket performs its own DNS lookup the record has been rebound to a private/internal IP (e.g. 169.254.169.254 cloud metadata or an internal service), causing the server to fetch attacker-chosen internal resources. No public proof-of-concept was provided in the input; exploitation requires winning the DNS resolution timing window (reflected by AC:H/AT:P).