{"record":{"id":"55ebbf5b4b275519","repo":"vercel/next.js","slug":"url-parameter-is-not-allowed","errorCode":null,"errorMessage":"\"url\" parameter is not allowed","messagePattern":"\"url\" parameter is not allowed","errorType":"http","errorClass":"ImageError","httpStatus":400,"severity":"error","filePath":"packages/next/src/server/image-optimizer.ts","lineNumber":882,"sourceCode":"    let ips = [hostname]\n    if (!isIP(hostname)) {\n      const records = await lookup(hostname, {\n        family: 0,\n        all: true,\n        hints: ALL,\n      }).catch((_) => [{ address: hostname }])\n      ips = records.map((record) => record.address)\n    }\n    const privateIps = ips.filter((ip) => isPrivateIp(ip))\n    if (privateIps.length > 0) {\n      Log.error(\n        'upstream image',\n        href,\n        'hostname resolved to private IP',\n        JSON.stringify(privateIps),\n        'If this is expected and you understand SSRF risk, use images.dangerouslyAllowLocalIP = true to continue.'\n      )\n      throw new ImageError(400, '\"url\" parameter is not allowed')\n    }\n  }\n  const res = await fetch(href, {\n    signal: AbortSignal.timeout(7_000),\n    redirect: 'manual',\n  }).catch((err) => err as Error)\n\n  if (res instanceof Error) {\n    const err = res as Error\n    if (err.name === 'TimeoutError') {\n      Log.error('upstream image response timed out for', href)\n      throw new ImageError(\n        504,\n        '\"url\" parameter is valid but upstream response timed out'\n      )\n    }\n    throw err\n  }","sourceCodeStart":864,"sourceCodeEnd":900,"githubUrl":"https://github.com/vercel/next.js/blob/0ae8c72462952df163f1b1e0726641bc5b40dc93/packages/next/src/server/image-optimizer.ts#L864-L900","documentation":"Thrown by fetchExternalImage (ImageError 400) when an external image URL's hostname resolves to a private/loopback IP and images.dangerouslyAllowLocalIP is false. Next.js performs DNS resolution (including all A/AAAA records) and rejects any private IP to prevent Server-Side Request Forgery (SSRF). This is a security guard, not a bug.","triggerScenarios":"An /_next/image?url=... request points at a hostname that resolves to a private IP (10.x, 192.168.x, 127.x, 169.254.x, etc.) and dangerouslyAllowLocalIP is not enabled. The privateIps filter is non-empty and the throw at line 882 fires.","commonSituations":"Pointing the image loader at an internal service on a private network. A hostname that is public today but resolves to a private range in a containerized/VPN environment. Local development with localhost-like hostnames. DNS rebinding where a hostname flips to a private IP.","solutions":["If SSRF risk is understood and acceptable, set images.dangerouslyAllowLocalIP = true in next.config.","Whitelist only safe remote domains via images.remotePatterns/domains instead of arbitrary URLs.","Move the upstream image host to a public IP/domain so it doesn't resolve privately.","For internal images, serve them locally and use fetchInternalImage instead of an external URL."],"exampleFix":"// before\nmodule.exports = { images: { remotePatterns: [{ protocol: 'https', hostname: '**' }] } }\n\n// after (explicit, allow local IP only if intended)\nmodule.exports = {\n  images: {\n    dangerouslyAllowLocalIP: true,\n    remotePatterns: [{ protocol: 'http', hostname: 'internal.local' }],\n  },\n}","handlingStrategy":"validation","validationCode":"// Pre-validate remote image URLs against your allowed, non-private hosts\nimport { isIP } from 'net'\nimport { lookup } from 'dns/promises'\nimport ipaddr from 'ipaddr.js'\nasync function isAllowedRemoteImage(href: string, allowedHosts: string[]) {\n  const { hostname } = new URL(href)\n  if (!allowedHosts.includes(hostname)) return false\n  const addrs = isIP(hostname) ? [hostname] : (await lookup(hostname, { all: true })).map(r => r.address)\n  return addrs.every(a => !ipaddr.parse(a).range().match(/^(private|loopback|linkLocal)$/))\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use images.remotePatterns with explicit hostnames, never a wildcard private range.","Only set dangerouslyAllowLocalIP after reviewing SSRF risk.","Validate remote image URLs at the data layer, not just at request time."],"tags":["image-optimization","ssrf","security","network"],"analyzedSha":"0ae8c72462952df163f1b1e0726641bc5b40dc93","analyzedAt":"2026-08-06T19:44:29.143Z","schemaVersion":2},"datasetVersion":"2026-08-07T02:17:10.218Z"}