Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| next | npm | >= 16.0.0, < 16.3.8 | 16.3.8 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-94483, describes a Server-Side Request Forgery (SSRF) in Next.js's Image Optimization feature, specifically exploitable through attacker-controlled, allow-listed remote URLs due to DNS rebinding. The provided commit e002ad68bd676bb0ed0c87bb22e3590304763e0b directly addresses this issue with the commit message '[lts-active] fix(next/image): Pin DNS resolution when fetching external images'.
Upon analyzing the diff in packages/next/src/server/image-optimizer.ts, the core of the fix lies within the fetchExternalImage function. In the vulnerable version, this function was responsible for fetching external images. It performed a DNS lookup to verify that the target hostname did not resolve to a private IP address. If this check passed, it would then proceed to fetch the image using the fetch API. The critical flaw was that the fetch API could perform its own, independent DNS resolution. This created a window for a DNS rebinding attack where the DNS record for the target hostname could be changed between the initial private IP check and the actual HTTP request, causing the fetch call to connect to a private IP address within the server's internal network.
The patch introduces a robust mechanism to 'pin' the DNS resolution. It replaces the fetch API with Node.js's native http.request and https.request functions, which allow for a custom lookup function. The new createPinnedLookup function ensures that once a hostname is resolved and checked against private IP ranges, all subsequent network connections to that hostname use only the initially verified IP addresses. This eliminates the time-of-check-to-time-of-use (TOCTOU) vulnerability that enabled the DNS rebinding attack. Therefore, fetchExternalImage is identified as the vulnerable function because it was the entry point for external image fetching and lacked this crucial DNS pinning, making it susceptible to SSRF.
fetchExternalImagepackages/next/src/server/image-optimizer.ts