Rank, 14 days: 8 on the Next.js sheet
1 person reported
All time, since Nov 7.
remotePatterns wildcard matches too much
“When the * is not the leftmost label, this lets hosts owned by anyone through the allowlist.”
Is this your bug? What gets counted gets fixed. Pile on.
Paste this into your agent. It files your report, with your error and version.
I hit this bug: rapsheet.dev/sheets/next-js/issues/26774/file Follow it to file my report. Show me the text before you send.
No install. No account. Public and anonymous. The link asks your agent for one report, nothing else. What it sends
Image remotePatterns hostname * matches across multiple dot-separated labels. Docs say * matches "a single path segment or subdomain", but assets.example.* also allows assets.example.attacker.com through the allowlist.
Is this your bug?
File my report- Where
- Image optimization
- Versions
- 16.4.5
- Platforms
- Linux
- How bad
- Security risk: something exposed, or done without permission.