/_next/image is a Next.js endpoint that serves optimized images. A Next.js application can use it to resize or convert images and deliver versions suited to a requested size or format. The route is commonly used during normal site operation, so a request to it is not, by itself, evidence of an attack.
In security monitoring, a web application firewall (WAF) may flag this route as a signal for investigation, including when defenders are watching for activity associated with a vulnerability. Treat such matches as telemetry, not proof of exploitation: review request details alongside application logs, runtime versions, and how the application processes input. If the route is not needed, operators can consider restricting it, but should test changes to avoid disrupting legitimate image delivery.