`Url parameter not allowed` after nextjs upgrade from 13.4.12 to 13.5.11 due to CVE-2025-29927

Link to the code that reproduces this issue

https://stackblitz.com/edit/stackblitz-starters-aaa2rwkz?description=The%20React%20framework%20for%20production&file=app%2Fpage.tsx,next.config.js,package.json&title=Next.js%20Starter

To Reproduce

1 Setup nextjs 13.5.11 project
2 Config next.config.js with image setting

  images: {
    remotePatterns: [
      {
        protocol: 'https',
        hostname: '**',
        port: '',
        pathname: '**',
      },
    ],
  },

3 At any pages, add these two images

      <Image
        width="100"
        height="100"
        src="https://www.vodafone.com.au/images/devices/apple/iphone-15-pro-max/iphone-15-pro-max-natural-titanium-feature1-m.jpg"
        alt="test"
      />

      <Image
        width="100"
        height="100"
        src="https://letsenhance.io/static/73136da51c245e80edc6ccfe44888a99/1015f/MainBefore.jpg"
        alt="test"
      />

The first image doesn't load

Current vs. Expected behavior

Current: get Url parameter not allowed response in image request
Expect: get image correctly

Provide environment information

Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 24.3.0: Thu Jan  2 20:24:06 PST 2025; root:xnu-11215.81.4~3/RELEASE_ARM64_T8103
Binaries:
  Node: 18.18.1
  npm: 9.8.1
  Yarn: 1.22.19
  pnpm: 9.5.0
Relevant Packages:
  next: 13.5.11
  eslint-config-next: 13.4.12
  react: 18.2.0
  react-dom: 18.2.0
  typescript: 4.9.5
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Image (next/image)

Which stage(s) are affected? (Select all that apply)

next dev (local), next start (local), Other (Deployed)

Additional context

In nextjs 13.4.12, we are using custom server and deployed our project in AWS Lambda. All images load fine. After upgrade to 13.5.11 because of middleware security issue , none of images can load.

Due to the cost of refactoring, we haven't had the chance to upgrade to Next.js 15, but we expect next/image to behave consistently in version 13

Start with the linked StackBlitz reproduction, then inspect next.config.js and app/page.tsx, focusing on the next/image requests and the change from Next.js 13.4.12 to 13.5.11. Compare the image behavior across those versions and verify completion when the Vodafone image loads without the “Url parameter not allowed” response in the stated development and deployed stages.