Next.js · sdk · fg-0305

next/image returns 400 '"url" parameter is not allowed' for a localhost or private-network image source

"url" parameter is not allowed

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

Next.js 16 blocks the image optimizer from fetching any host that resolves to a private IP, as SSRF protection. remotePatterns does not override it, and split-horizon DNS inside a VPC trips it too.

Fix

Enable images.dangerouslyAllowLocalIP only in development or on a private network you control, or serve the images from a public host.

Apply

// next.config.ts
export default {
  images: { dangerouslyAllowLocalIP: process.env.NODE_ENV === 'development' },
}

Affects: Next.js 16.0 and later (reproduced in 16.4.1 source)

Sources

• https://nextjs.org/docs/app/guides/upgrading/version-16
• https://github.com/vercel/next.js/issues/88873

claude mcp add --transport http footgun https://getfootgun.com/api/mcp