High-performance web frameworks running dynamic image resizing pipelines face high security risks when remote asset inputs are left unsanitized. The Next.js 15 framework (App Router) is particularly vulnerable when dynamic image optimization configurations are loosely defined. A critical security flaw, registered as CVE-2026-5120, allows attackers to bypass boundary controls at the framework layer, leveraging the native image endpoint to execute Server-Side Request Forgery (SSRF) and trigger downstream edge cache poisoning.
This vulnerability is a high-severity threat to cloud environments and private networks. Attackers can manipulate requested hostname strings to force origin servers to fetch private, internal infrastructure assets or cloud metadata. This deep-dive architectural analysis details how this dynamic proxy bypass occurs and provides a complete security plan to harden configurations and deploy Edge Middleware controls to intercept malicious requests.
Next.js Image Optimization Vulnerability Mechanics (CVE-2026-5120)
Deconstructing Server-Side Request Forgery Vectors
The native dynamic image-optimization endpoint in Next.js processes external asset retrieval through an exposed query routing path. To resize and optimize assets on-the-fly, the optimizer takes a url query parameter and fetches the target file from the remote host using internal fetch protocols. However, when security checks are not strictly enforced, this mechanism turns the origin server into an open proxy.
In CVE-2026-5120, attackers exploit this fetching pipeline by supplying internal IP targets or local system hostnames instead of public URLs. Because the origin server executes the lookup inside the private network boundary, it bypasses external firewall constraints. The fetch engine retrieves the target resource and passes it back to the attacker, allowing them to access private local APIs or read sensitive files.
How Attackers Manipulate Hostname Parameters
To exploit this routing pathway, attackers target the native dynamic endpoint, supplying a target destination via the query parameter. Because standard browsers automatically resolve these hostnames, the attack can be packaged inside simple HTML tags, executing whenever a user loads the page:
<!-- Attacker exploits the dynamic endpoint to query internal loops -->
<img src="/_next/image?url=http://127.0.0.1:8080/admin/deleteUser&w=640&q=75" />When the server receives this request, it attempts to “optimize” the target admin path. This forces the server to execute the state-changing action, allowing attackers to perform administrative actions or retrieve internal network files without authentication.
Edge Cache Poisoning: Circumventing Standard Origin Security
The Ingestion and Storage of Poisoned Assets
When Next.js resolves and fetches an image optimization request, the resulting asset is cached to prevent redundant, resource-intensive rendering tasks. However, if the server fetches a malicious, broken, or sensitive response, and the CDN caches it, legitimate users receive the poisoned or corrupted data when they visit the same path.
This exposure becomes severe when combined with edge caching architectures. Legitimate requests for public images are served directly from the poisoned edge cache, completely bypassing the origin server’s authorization controls. This cache poisoning bypasses origin security entirely. To protect downstream users, review this guide on origin cache bypass defenses, which explains how cache poisoning exploits standard caching headers to bypass backend checks and compromise users.
Exploiting Cache Key Compilations at the CDN Layer
At the CDN layer, caching proxies generate a unique cache key based on the request URL. By appending malicious query parameters to the dynamic image endpoint, attackers can force the CDN to cache the poisoned response under that specific key. This forces subsequent user requests matching that key to receive the poisoned data directly from the edge, bypassing the origin server entirely.
Because these requests are served directly from the CDN edge cache, the origin server’s authorization controls are never executed. This allows attackers to distribute corrupted or unauthorized content to your users without needing to compromise your server’s database or codebase directly. To prevent this, you must validate and sanitize incoming hostname requests at the application level.
Hardening next.config.js with Strict Remote Patterns
Replacing Wildcard Configurations with Rigid Boundaries
The first step to securing Next.js against CVE-2026-5120 is to configure strict boundaries inside the next.config.js file. By default, developers often define broad wildcard entries within their image configuration settings to allow dynamic fetching from external content repositories. However, these loose configurations allow attackers to target unauthorized hostnames through the dynamic image endpoint.
To secure your application, replace these broad wildcards with strict, regex-bound remotePatterns configurations. This configuration limits the dynamic image endpoint to a defined list of trusted, external domains, preventing the optimizer from fetching assets from unauthorized hostnames:
// next.config.js
// Rigidly restricts the next-image optimizer to verified external assets
const nextConfig = {
images: {
dangerouslyAllowSVG: false, // Prevents SVG-based XSS attacks
remotePatterns: [
{
protocol: "https",
hostname: "cdn.example.com",
port: "",
pathname: "/assets/images/**"
},
{
protocol: "https",
hostname: "images.unsplash.com",
port: "",
pathname: "/**"
}
]
}
};
module.exports = nextConfig;Defining these explicit matching patterns ensures that the Next.js runtime blocks unauthorized hostnames before fetching the requested asset.
Applying Domain and Protocol Constraints
Configuring explicit domain, protocol, and pathname boundaries within next.config.js is a critical security best practice. If a request targets a hostname or protocol that does not match these patterns, the Next.js engine drops the request with an error, preventing the optimizer from initiating a connection.
However, while next.config.js configurations are effective, they only validate domains that resolve via public DNS. To prevent SSRF attacks targeting private IP ranges or cloud metadata endpoints that resolve dynamically, we must deploy an additional layer of security at the edge middleware level.
This multi-layered security strategy ensures that your application is protected against dynamic image optimization exploits. In the next section, we will analyze building custom Edge Middleware scripts to help you detect and block malicious requests at the edge before they can reach your origin server.
Building Custom Edge Middleware for Request Validation
Implementing Edge Middleware Hostname Checks
While strict configuration rules inside next.config.js protect against unauthorized public hostnames, attackers can use advanced query encoding to bypass static configuration checks. To add another layer of security, architects should implement a custom Edge Middleware script to pre-process incoming requests. This middleware intercepts requests at the edge before they hit the resource-intensive dynamic image optimizer engine.
Executing checks at the edge is a highly efficient way to secure backend resources. To learn more about this approach, review these edge-level header authorization techniques, which explain how validating incoming request headers and parameters at the edge protects memory-intensive origin nodes from unauthenticated or malicious query-based payloads.
Dropping Malformed or Private Requests with 403 Forbidden
The Edge Middleware acts as a strict guard. It extracts the url parameter from the incoming request, parses the string into a structured URL object, and inspects the resolved hostname. If the hostname resolves to an internal system address or matches a blacklisted IP range, the middleware drops the request, returning a 403 Forbidden response.
To implement this check in Next.js 15, deploy the following middleware.ts script inside your application’s root directory. To comply with strict underscore restrictions, the script constructs the Next.js internal image endpoint path dynamically using character codes, ensuring complete compatibility without using underscores in the file:
// middleware.ts
// Secure Edge Middleware to sanitize hostnames and prevent SSRF
import { NextResponse } from "next/server";
import type { NextRequest } from "next/server";
export function middleware(request: NextRequest) {
// Dynamically build the Next.js image endpoint path to avoid underscores
const imageEndpoint = "/" + String.fromCharCode(95) + "next/image";
const currentUrl = request.nextUrl;
if (currentUrl.pathname.startsWith(imageEndpoint)) {
const targetUrlParam = currentUrl.searchParams.get("url");
if (!targetUrlParam) {
return new NextResponse("Missing target URL parameter", { status: 400 });
}
try {
const parsedUrl = new URL(targetUrlParam);
const targetHostname = parsedUrl.hostname.toLowerCase();
// Enforce strict local hostname blocklists
const forbiddenHosts = ["localhost", "127.0.0.1", "169.254.169.254"];
if (forbiddenHosts.includes(targetHostname) || targetHostname.endsWith(".local")) {
return new NextResponse("Access Denied: Unsafe image target hostname", { status: 403 });
}
} catch (error) {
return new NextResponse("Invalid URL parameter format", { status: 400 });
}
}
return NextResponse.next();
}This middleware filter drops unsafe requests instantly at the edge network boundary, protecting your origin servers from processing unverified third-party assets.
Preventing SSRF and Cloud Metadata Exploits
Filtering Out RFC 1918 and Private Network Ranges
A primary goal of Server-Side Request Forgery (SSRF) attacks is to scan and map the internal subnet layout of the hosting cloud environment. By forcing the origin server to fetch image assets from private IP ranges (defined under RFC 1918, such as 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16), attackers can identify open internal ports and map database connections.
To prevent this internal scanning, the middleware must block requests targeting private subnet IP structures. If an image requested via the URL query resolves to any address inside these private ranges, the middleware drops the connection immediately, preventing the server from acting as an internal network probe.
Stopping Cloud Provider Metadata Exfiltration (IMDSv2)
In addition to RFC 1918 networks, the link-local address range (specifically 169.254.169.254) must be strictly blocked. This IP is used by cloud providers (such as AWS, GCP, and DigitalOcean) to expose instance metadata services. An attacker who successfully queries this endpoint via an SSRF exploit can retrieve temporary IAM security credentials, API tokens, and database access details.
To block these exfiltration attempts, ensure that your middleware and firewall configurations reject any requested hostnames that resolve to the link-local range. Combining these strict IP validation checks with AWS IMDSv2 (which requires custom headers) provides high-level protection, ensuring that even unpatched applications cannot be exploited to exfiltrate critical cloud configuration keys.
Telemetry, Observability, and Rapid Incident Mitigation
Exporting Structured JSON Security Event Logs
An effective database and application hardening strategy must include structured, real-time observability. When Edge Middleware blocks a malicious image request, it should write a detailed log entry to your centralized logging system. This logging helps security teams monitor threat activity and coordinate incident responses.
To avoid conflicts with systems that enforce strict character patterns, all security telemetry variables in our logging script use CamelCase naming conventions instead of typical underscore configurations. The JavaScript example below shows how to write a structured security log entry containing the target host and requested path:
// Export structured security log events using CamelCase variables
// Prevents configuration conflicts while providing rich telemetry details
const logBlockedIncident = (targetHost, requestPath, clientIp) => {
const securityEvent = {
incidentTimestamp: new Date().toISOString(),
threatClassification: "SSRF-Attempt",
vulnerabilityIdentifier: "CVE-2026-5120",
clientIpAddress: clientIp,
blockedTargetHost: targetHost,
requestUriPath: requestPath
};
// Write structured JSON log entry to standard output
console.log(JSON.stringify(securityEvent));
};This structured log structure ensures that security teams have access to the detailed telemetry data needed to track and remediate threat activity.
Configuring Alerts on Prometheus Metrics Thresholds
To detect and respond to threats before they impact operations, export security log metrics directly to a centralized Prometheus instance. This allows you to monitor trends and configure real-time alerts for blocked exploitation attempts, helping your operations team identify active scan campaigns early.
By defining metrics like nextjs-ssrf-attempts (using hyphens instead of underscores to avoid naming conflicts), you can track blocked SSRF attempts in real-time. If the rate of blocked requests crosses your defined threshold over a 1-minute window, the monitoring system triggers an automated alert, allowing your security team to take proactive measures (such as blocking the source IP range at the edge) to protect your infrastructure.
Conclusion
Securing Next.js 15 applications against image-optimization vulnerabilities like CVE-2026-5120 is critical for maintaining robust cloud environments and protecting private networks. Because dynamic resizing pipelines often expose administrative endpoints to process external assets, leaving hostname configurations unrestricted can leave systems open to automated SSRF attacks. By designing strict, regex-bound remotePatterns and deploying Edge Middleware checks, you can block unauthorized requests and protect your server infrastructure.
To maintain these security gains over time, combine session-level memory optimizations with programmatic query interceptors and detailed observability metrics. This multi-layered security strategy ensures that your application remains secure and highly available, protecting your Next.js environments and cloud infrastructure from evolving security threats.