Next.js 16 Image Optimization returns "url parameter is not allowed" for external domains despite correct remotePatterns configuration

[duongseedcom]

Link to the code that reproduces this issue

https://codesandbox.io/p/devbox/sweet-field-8rvv9c

To Reproduce

1. Create a Next.js 16 app with remotePatterns configured for storage.googleapis.com
2. Add the following to next.config.js:

   images: {
     remotePatterns: [
       {
         protocol: 'https',
         hostname: 'storage.googleapis.com',
         pathname: '/**',
         search: ''
       },
       {
         protocol: 'https',
         hostname: 'img.onelife.vn'
       }
     ]
   }

3. Build and deploy with Docker (ensure next.config.js is copied to production image)
4. Test image optimization endpoint:

• ✅ Works: /_next/image?url=https%3A%2F%2Fimg.onelife.vn%2Fexample.webp&w=128&q=75
• ❌ Fails: /_next/image?url=https%3A%2F%2Fstorage.googleapis.com%2Fonelife-public%2Fmedia%2Fimages%2F2026%2F01%2FBy5AXgblob&w=128&q=75

5. Observe 400 Bad Request with "url parameter is not allowed" for storage.googleapis.com
6. Downgrade to Next.js 15.5.9 - same URL now works

Current vs. Expected behavior

Expected: Both URLs should return optimized images since both hostnames are configured in remotePatterns:
https://img.onelife.vn/... → ✅ optimized image
https://storage.googleapis.com/... → ✅ optimized image

Actual (Current):
https://img.onelife.vn/... → ✅ optimized image (works)
https://storage.googleapis.com/... → ❌ 400 Bad Request "url parameter is not allowed"

Key finding:
Same configuration works in Next.js 15.5.9
Same configuration fails in Next.js 16 for storage.googleapis.com only
Other domains like img.onelife.vn work fine in Next.js 16

Provide environment information

Operating System:
  Platform: linux (Docker Alpine)
  Arch: x64
Binaries:
  Node: 22.21.1
  npm: 10.x
  Yarn: 1.22.x
Relevant Packages:
  next: 16.x.x Pages Router (worked in 15.5.9)
  react: 19.x
  sharp: 0.31.3

Which area(s) are affected? (Select all that apply)

Image (next/image)

Which stage(s) are affected? (Select all that apply)

Other (Deployed)

Additional context

Deployment: Docker with Alpine Node image (node:22.21.1-alpine) Dockerfile confirms next.config.js is copied:

COPY --from=builder /app/next.config.js ./next.config.js

Version comparison:

• Next.js 15.5.9: ✅ storage.googleapis.com works
• Next.js 16.x: ❌ storage.googleapis.com returns "url parameter is not allowed"

Observations:

• The issue appears specific to certain hostnames (public cloud storage like storage.googleapis.com)
• Custom domains (img.onelife.vn) work fine with identical remotePatterns config
• This suggests Next.js 16 may have added hostname-based filtering/blocking for security that's too aggressive
• Workaround: Currently using tags instead of for storage.googleapis.com URLs, or proxying through img.onelife.vn

[cdown]

What does storage.googleapis.com resolve to on your network? You can check with getent hosts storage.googleapis.com. I ask because in v16, there is a new feature called dangerouslyAllowLocalIP, see commit 8d41585.

[aelfannir]

Same

Edit by maintainer bot: Comment was automatically minimized because it was considered unhelpful. (If you think this was by mistake, let us know). Please only comment if it adds context to the issue. If you want to express that you have the same problem, use the upvote 👍 on the issue description or subscribe to the issue for updates. Thanks!