Next.js 16.4.0-canary.13 Image Optimizer DNS Rebinding TOCTOU SSRF Still Exists
Next.js 16.4.0-canary.13 Image Optimizer retains a DNS rebinding TOCTOU SSRF in fetchExternalImage() allowing requests to private network resources.
Next.js 16.4.0-canary.13 contains a DNS rebinding time-of-check-to-time-of-use Server-Side Request Forgery vulnerability in the Image Optimizer's fetchExternalImage() function. The code resolves the supplied hostname and checks the resulting addresses with isPrivateIp(), but a TOCTOU gap between resolution and the actual fetch allows an attacker-controlled DNS record to change and reach private network resources.
- TOCTOU gap between hostname resolution and the isPrivateIp() check enables DNS rebinding.
- SSRF lets attackers make the Image Optimizer fetch private network resources.
- Affects the fetchExternalImage() function in Next.js 16.4.0-canary.13.
Posted by Ron E on Sep 03 Next.js 16.4.0-canary.13 contains a DNS rebinding TOCTOU Server-Side Request Forgery vulnerability in the Image Optimizer's fetchExternalImage() functionality. Next.js attempts to prevent requests to private network resources by resolving the supplied hostname and checking the resulting addresses using isPrivateIp(): const records = await lookup(hostname, { family: 0, all: true, hints: ALL, }) const privateIps = records.map((record)...
This source does not provide full text. Read it at seclists.org.