{"schema":"vulnpedia.research/1","cve":"CVE-2026-94483","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4","tags":["x_refsource_CONFIRM","Vendor Advisory","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-02T15:18:38.684Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-02T15:18:38.684Z","url":"https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4"},{"source":"nvd","sourceId":"CVE-2026-94483","modified":"2026-10-06T17:17:27.837","url":"https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4"},{"source":"ghsa","sourceId":"GHSA-cjq9-62q9-8jv4","url":"https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4"},{"source":"ghsa","sourceId":"GHSA-cjq9-62q9-8jv4","modified":"2026-10-07T20:45:06.190363835Z","url":"https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4"},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4"}]},{"url":"https://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b","tags":["x_refsource_MISC","Patch","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-02T15:18:38.684Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-02T15:18:38.684Z","url":"https://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b"},{"source":"nvd","sourceId":"CVE-2026-94483","modified":"2026-10-06T17:17:27.837","url":"https://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b"},{"source":"ghsa","sourceId":"GHSA-cjq9-62q9-8jv4","url":"https://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b"},{"source":"ghsa","sourceId":"GHSA-cjq9-62q9-8jv4","modified":"2026-10-07T20:45:06.190363835Z","url":"https://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b"},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b"}]},{"url":"https://github.com/vercel/next.js/releases/tag/v16.3.8","tags":["x_refsource_MISC","Release Notes","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-02T15:18:38.684Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-02T15:18:38.684Z","url":"https://github.com/vercel/next.js/releases/tag/v16.3.8"},{"source":"nvd","sourceId":"CVE-2026-94483","modified":"2026-10-06T17:17:27.837","url":"https://github.com/vercel/next.js/releases/tag/v16.3.8"},{"source":"ghsa","sourceId":"GHSA-cjq9-62q9-8jv4","url":"https://github.com/vercel/next.js/releases/tag/v16.3.8"},{"source":"ghsa","sourceId":"GHSA-cjq9-62q9-8jv4","modified":"2026-10-07T20:45:06.190363835Z","url":"https://github.com/vercel/next.js/releases/tag/v16.3.8"},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://github.com/vercel/next.js/releases/tag/v16.3.8"}]},{"url":"https://osv.dev/vulnerability/GHSA-cjq9-62q9-8jv4","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-cjq9-62q9-8jv4","modified":"2026-10-07T20:45:06.190363835Z","origins":[{"source":"ghsa","sourceId":"GHSA-cjq9-62q9-8jv4","url":"https://osv.dev/vulnerability/GHSA-cjq9-62q9-8jv4"},{"source":"ghsa","sourceId":"GHSA-cjq9-62q9-8jv4","modified":"2026-10-07T20:45:06.190363835Z","url":"https://osv.dev/vulnerability/GHSA-cjq9-62q9-8jv4"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94483","tags":["ADVISORY","vendor-reference"],"source":"ghsa","sourceId":"GHSA-cjq9-62q9-8jv4","modified":"2026-10-07T20:45:06.190363835Z","origins":[{"source":"ghsa","sourceId":"GHSA-cjq9-62q9-8jv4","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94483"},{"source":"ghsa","sourceId":"GHSA-cjq9-62q9-8jv4","modified":"2026-10-07T20:45:06.190363835Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94483"},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94483"}]},{"url":"https://github.com/vercel/next.js","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-cjq9-62q9-8jv4","modified":"2026-10-07T20:45:06.190363835Z","origins":[{"source":"ghsa","sourceId":"GHSA-cjq9-62q9-8jv4","url":"https://github.com/vercel/next.js"},{"source":"ghsa","sourceId":"GHSA-cjq9-62q9-8jv4","modified":"2026-10-07T20:45:06.190363835Z","url":"https://github.com/vercel/next.js"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-94483","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-94483"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545232","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545232"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94483","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-94483"}]},{"source":"euvd","sourceId":"EUVD-2026-91671","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91671","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-91671","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91671"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-cjq9-62q9-8jv4","url":"https://osv.dev/vulnerability/GHSA-cjq9-62q9-8jv4","ecosystem":"npm","name":"next","purl":"pkg:npm/next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"16.3.8"}]}],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-cjq9-62q9-8jv4/GHSA-cjq9-62q9-8jv4.json"},"modified":"2026-10-07T20:45:06.190363835Z","origins":[{"source":"ghsa","sourceId":"GHSA-cjq9-62q9-8jv4","modified":"2026-10-07T20:45:06.190363835Z","url":"https://osv.dev/vulnerability/GHSA-cjq9-62q9-8jv4"}]}],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_enterprise_linux_10:firefox","product":"firefox as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/firefox","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_enterprise_linux_10:firefox.src","product":"firefox.src as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/firefox?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_enterprise_linux_10:thunderbird","product":"thunderbird as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/thunderbird","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_enterprise_linux_10:thunderbird.src","product":"thunderbird.src as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/thunderbird?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_enterprise_linux_7:firefox","product":"firefox as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/firefox","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_enterprise_linux_7:firefox.src","product":"firefox.src as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/firefox?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_enterprise_linux_8:firefox","product":"firefox as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/firefox","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_enterprise_linux_8:firefox.src","product":"firefox.src as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/firefox?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_enterprise_linux_8:thunderbird","product":"thunderbird as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/thunderbird","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_enterprise_linux_8:thunderbird.src","product":"thunderbird.src as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/thunderbird?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_enterprise_linux_9:firefox","product":"firefox as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/firefox","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_enterprise_linux_9:firefox-x11","product":"firefox-x11 as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/firefox-x11","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_enterprise_linux_9:firefox.src","product":"firefox.src as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/firefox?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_enterprise_linux_9:thunderbird","product":"thunderbird as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/thunderbird","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_enterprise_linux_9:thunderbird.src","product":"thunderbird.src as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/thunderbird?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-cuda-rhel9","product":"rhelai3/bootc-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-cuda-rhel9@sha256:b45f3bc25a7d3c9f3bfdc1de3be6db59f6c3109f62326d74fae14e832a797981?repository_url=registry.redhat.io/rhelai3/bootc-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-gaudi-rhel9","product":"rhelai3/bootc-gaudi-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-gaudi-rhel9@sha256:e1057b59ca1be9501332abf97230855e85c7df858356be0da9dce230ea7e98e1?repository_url=registry.redhat.io/rhelai3/bootc-gaudi-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-rocm-rhel9","product":"rhelai3/bootc-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-rocm-rhel9@sha256:38ce057f97034bbb8eaea574d41cc7eebaeaa9265a4cdd966476dd3fac129c3c?repository_url=registry.redhat.io/rhelai3/bootc-rocm-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/disk-image-cuda-rhel9","product":"rhelai3/disk-image-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/disk-image-cuda-rhel9@sha256:5489bd1cdbb7f1a5ce80e9ad688b66c6bb8688b2b202a2a86b5c2205cdd6e126?repository_url=registry.redhat.io/rhelai3/disk-image-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]},{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json","productId":"red_hat_trusted_artifact_signer:rhtas/rekor-search-ui-rhel9","product":"rhtas/rekor-search-ui-rhel9 as a component of Red Hat Trusted Artifact Signer","status":"known_affected","remediations":[{"category":"workaround","details":"Audit and restrict the `images.remotePatterns` configuration in `next.config.js` to eliminate untrusted hostnames, or remove the `remotePatterns` configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.\n\nCaveats: Disabling or removing remote image entries will prevent external image optimization.\n\nWarning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:oci/rekor-search-ui-rhel9@sha256:7933b00020529ecbdfa107a238939773c9aa003cfa12e2236a2d397dc22acc52?repository_url=registry.redhat.io/rhtas/rekor-search-ui-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-94483","modified":"2026-10-22T21:18:36+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94483.json"}]}],"vendorCoverage":{"total":20,"shown":20,"omitted":0,"source":"redhat"}}