Posted by Ron E on Sep 03 Next.js 16.4.0-canary.13 contains a DNS rebinding TOCTOU Server-Side

Request Forgery vulnerability in the Image Optimizer's fetchExternalImage()

functionality.

Next.js attempts to prevent requests to private network resources by

resolving the supplied hostname and checking the resulting addresses using

isPrivateIp():

const records = await lookup(hostname, {

family: 0,

all: true,

hints: ALL,

})

const privateIps = records.map((record)...