mediumYour server fetching attacker-chosen URLs

Image Optimizer Accepts Any Remote Host

The Next.js image optimizer is allowed to fetch from any host on the internet.

Why it matters

/_next/image downloads the URL it is given and serves the result from your server. With every host allowed, anyone can make your server fetch arbitrary URLs: a free proxy at best, and on Next.js versions with the image SSRF advisory, a way to reach services that are only meant to be reachable from inside your network.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

remotePatterns wildcard hostname

/** @type {import('next').NextConfig} */
const nextConfig = {
  images: {
    remotePatterns: [{ protocol: 'https', hostname: '**' }],
  },
};
module.exports = nextConfig;

The smallest fix

minimal patch

// next.config.js
images: {
  remotePatterns: [
    { protocol: 'https', hostname: 'cdn.example.com' },
    { protocol: 'https', hostname: '*.supabase.co', pathname: '/storage/v1/object/public/**' },
  ],
},

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

safe alternative

// For user-supplied image URLs, do not run them through the optimizer at all:
<Image src={url} unoptimized alt="" />
// and keep Next.js at or above the version that fixed the image SSRF advisory.

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

In [the file] at line [the line number] the image optimizer is open to every hostname: [the flagged code]. Replace the wildcard with the exact hosts the app loads images from (a leading *. for one level of subdomain is fine). For images users link to, render them with the unoptimized prop instead of allowing all hosts. Then update Next.js to the latest patch release.

How to check the fix worked

1. Request /_next/image?url=https://example.org/x.png&w=64&q=75 and
   confirm a 400 for a host that is not listed.
2. Confirm images from the listed hosts still render.