Executive brief
Next.js is a popular web framework used to build production-grade JavaScript applications. Self-hosted Next.js applications with image optimization enabled and configured to load images from external domains are vulnerable to denial-of-service attacks. An attacker with control over an allowed image source can cause the server to load extremely large images into memory without limits, exhausting available memory and crashing the application.
Technical details
The vulnerability exists in the Image Optimizer endpoint (/_next/image) which loads external images entirely into memory without enforcing a maximum size limit. The vulnerability is classified as resource exhaustion (CWE-770) and affects self-hosted deployments where remotePatterns is configured to allow image optimization from external domains. An attacker must be able to serve or control a large image on an allowed domain, then make requests to the Image Optimizer endpoint to trigger out-of-memory conditions. The attack requires network access and high attack complexity (the attacker must control a domain in the remotePatterns allowlist). Patches are available in Next.js versions 15.5.10 and 16.1.5.
Affected products
- Vercel Next.js 10.0.0 through 15.5.9 and 16.0.0 through 16.1.4
Timeline
- 2026-01-26: disclosed: Advisory published on GitHub
- 2026-01-27: patched: Patches released in Next.js 15.5.10 and 16.1.5