Next.js 16.4.0-canary.13 Image Optimizer DNS Rebinding TOCTOU SSRF Still Exists

<p>Posted by Ron E on Sep 03</p>Next.js 16.4.0-canary.13 contains a DNS rebinding TOCTOU Server-Side<br /> Request Forgery vulnerability in the Image Optimizer&apos;s fetchExternalImage()<br /> functionality.<br /> <br /> Next.js attempts to prevent requests to private network resources by<br /> resolving the supplied hostname and checking the resulting addresses using<br /> isPrivateIp():<br /> <