cloudflare / cloudflare/vinext

next/image: reject non-2xx internal image responses

Open
#3,117 0 comments 0 reactions 0 assignees View on GitHub
nextjs-tracking
Dominant language
TypeScript
Stars
8.8k
Forks
406
Avg merge
2d 6h
Merged PRs (30d)
120

Description

## Next.js Change

**Commit:** [`fad3175`](https://github.com/vercel/next.js/commit/fad317505d47cc0d47ca6973f8470494ece4f289)
**PR:** [#97957](https://github.com/vercel/next.js/pull/97957)

## What changed

Next.js now rejects every non-2xx response when the image optimizer fetches a local/internal image. Previously redirects and missing local images could be treated as successful image input, later failing with a misleading invalid-image error. The optimizer now reports an internal-response error, preserves a 404 status for missing images, and maps redirect statuses below 400 to a 500 error.

## Impact on vinext

vinext exposes `next/image` and needs matching behavior wherever its image optimizer resolves local image URLs through the application request handler. Redirects, authorization failures, and missing assets must not proceed to image decoding.

What to check/do:

1. Reject internal image-fetch responses outside the 200-299 range before content-type detection or image optimization.
2. Preserve the internal response status in the resulting image error, including 404 for missing images and 500 for redirects.
3. Ensure non-image local content that returns 2xx continues to produce the existing invalid-image response.
4. Add focused coverage for redirected and missing internal image URLs in development and production.

## Related

- Upstream image optimizer coverage in `test/unit/image-optimizer/fetch-internal-image.test.ts` and `test/e2e/image-optimizer/util.ts`

Contributor guide

Open the contributing guide

Research direction

Start by tracing vinext’s next/image optimizer path where local or internal image URLs are fetched, then compare its behavior with test/unit/image-optimizer/fetch-internal-image.test.ts and test/e2e/image-optimizer/util.ts. Add focused development and production coverage for redirected and missing internal URLs; done means non-2xx responses stop before decoding, statuses are preserved or mapped as described, and 2xx non-images retain the existing invalid-image response.

Written by the indexing model from the issue text.

Assessment

Tech stack
next.js, typescript
Domain
backend, web-dev
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.