Executive brief
Next.js is a popular framework used to build and host web applications. A vulnerability in its image processing component allows an attacker to crash the web server by requesting very large images, leading to a service outage. This issue primarily affects organizations that self-host their Next.js applications rather than using the Vercel platform.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in the Next.js Image Optimization API. When self-hosting with the default image loader, the API fetches local images entirely into memory without enforcing a maximum size limit. An unauthenticated remote attacker can exploit this by sending crafted requests to the /_next/image endpoint for large local assets that match the images.localPatterns configuration. This results in an out-of-memory (OOM) condition and a Denial of Service. The vulnerability is fixed in versions 15.5.16 and 16.2.5 by implementing consistent response size limits via the images.maximumResponseBody configuration.
Affected products
- Vercel Next.js >= 10.0.0, < 15.5.16; >= 16.0.0, < 16.2.5
- Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Red Hat Trusted Artifact Signer
- Red Hat streams for Apache Kafka 2
- Red Hat streams for Apache Kafka 3
Timeline
- 2026-05-06: advisory: GitHub Advisory GHSA-h64f-5h5j-jqjh published
- 2026-05-13: disclosed: CVE-2026-44577 published to NVD