Log in Start free

Vulnerability · Published May 13, 2026 · Assigned by GitHub_M

CVE-2026-44577Next.js: Denial of Service in the Image Optimization API

Medium 5.9

In plain English

A medium-severity resource allocation without limits in next.js from vercel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.7%top 45.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmnext15.5.16GHSA-h64f-5h5j-jqjh
npmnext16.2.5GHSA-h64f-5h5j-jqjh

Affected products (as reported)

VendorProductVersions
vercel next.js >= 10.0.0, < 15.5.16>= 16.0.0, < 16.2.5

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References