Description
An overly permissive "remotePatterns" configuration in the Image component of a Next.js app can allow unauthenticated attackers to send arbitrary requests to any host, including those on internal networks that are otherwise inaccessible externally. This misconfiguration can be exploited to carry out SSRF (Server-Side Request Forgery) attacks on the server
Remediation
Restrict access to third-parties with "remotePatterns" in next.config.js