Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitylow

Next.js 16.4.0-canary.13 Image Optimizer DNS Rebinding TOCTOU SSRF Still Exists

Full Disclosure ()3 · 1 read
Read at seclists.org
AI summary · glm-5.3-flashSummaries by Vani AI

Next.js 16.4.0-canary.13 Image Optimizer retains a DNS rebinding TOCTOU SSRF in fetchExternalImage() allowing requests to private network resources.

Next.js 16.4.0-canary.13 contains a DNS rebinding time-of-check-to-time-of-use Server-Side Request Forgery vulnerability in the Image Optimizer's fetchExternalImage() function. The code resolves the supplied hostname and checks the resulting addresses with isPrivateIp(), but a TOCTOU gap between resolution and the actual fetch allows an attacker-controlled DNS record to change and reach private network resources.

Key facts
  • TOCTOU gap between hostname resolution and the isPrivateIp() check enables DNS rebinding.
  • SSRF lets attackers make the Image Optimizer fetch private network resources.
  • Affects the fetchExternalImage() function in Next.js 16.4.0-canary.13.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
dns-rebindingnextjsssrftoctouvulnerability
Vendors
Vercel
Products
Next.js

From the original article

Posted by Ron E on Sep 03 Next. js 16. 4.

Full Disclosure

seclists.org

Read the full article at Full Disclosure

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.