Vulnerability · Published Mar 18, 2026 · Assigned by GitHub_M
CVE-2026-27980Next.js: Unbounded next/image disk cache growth can exhaust storage
Medium 6.9
In plain English
A medium-severity uncontrolled resource consumption in next.js from vercel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. This is fixed in version 16.1.7 by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. If upgrading is not immediately possible, periodically clean `.next/cache/images` and/or reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | next | 16.1.7 | GHSA-3x4c-7xq6-9pq8 |
| npm | next | 15.5.14 | GHSA-3x4c-7xq6-9pq8 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References
- https://github.com/vercel/next.js/security/advisories/GHSA-3x4c-7xq6-9pq8 x_refsource_CONFIRM
- https://github.com/vercel/next.js/commit/39eb8e0ac498b48855a0430fbf4c22276a73b4bd x_refsource_MISC
- https://github.com/vercel/next.js/releases/tag/v16.1.7 x_refsource_MISC