GitHub Advisoryadvisory · npm

GHSA-q8wf-6r8g-63ch Next.js: Denial of Service in the Image Optimization API using SVGs

MEDIUM Published 2026-07-22 Modified 2026-07-22 Official page ↗
Aliases
CVE-2026-64644
Ecosystem
npm
Packages
next
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-407
Reviewed
2026-07-22

Affected packages

• npm next: >= 15.5.0, < 15.5.21 → fixed in 15.5.21 • npm next: >= 16.0.0, < 16.2.11 → fixed in 16.2.11

Description

Impact When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in `/_next/image` endpoints. • If you are using `config.images.remotePatterns`, only the patterns in that array are impacted. • If you are using `config.images.unoptimized: true`, you are NOT impacted. • If you are using `config.images.loader: 'custom'`, you are NOT impacted. • If you are using Vercel, you are NOT impacted. Workarounds If you cannot upgrade immediately, you can avoid the expensive work by setting `config.experimental.imgOptSkipMetadata : true`.

Related

Alias · CVE (1)

  • CVE-2026-64644 Next.js is a React framework for building full-stack web applications. vulnerability

Weakness · CWE (1)

  • CWE-407 Inefficient Algorithmic Complexity weakness

References