Is CVE-2026-44577 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44577 being exploited in the wild.

How severe is CVE-2026-44577?

Medium severity, with a CVSS score of 5.9, published 13 May 2026.

Which products and versions are affected?

next (npm) SEMVER:introduced=10.0.0,fixed=15.5.16; Vercel Next.js >= 10.0.0, = 16.0.0, < 16.2.5, 10.0.0 to < 15.5.16, 16.0.0 to < 16.2.5.

Is there a fix for CVE-2026-44577?

Yes. next (npm): upgrade to 15.5.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44577 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44577?

Check whether you run next (npm), Red Hat Enterprise Linux AI (RHEL AI), Red Hat Trusted Artifact Signer or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44577: Vercel Next.js denial of service in Image Optimization API

Q: Is there a fix for CVE-2026-44577?

Yes. next (npm): upgrade to 15.5.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44577 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44577?

Check whether you run next (npm), Red Hat Enterprise Linux AI (RHEL AI), Red Hat Trusted Artifact Signer or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44577 · Severity: medium · CVSS 5.9 · Published 2026-05-13

Next.js is a popular framework used to build and host web applications. A vulnerability in its image processing component allows an attacker to crash the web server by requesting very large images, leading to a service outage. This issue primarily affects organizations that self-host their Next.js applications rather than using the Vercel platform.

Technologies: next (npm), Red Hat Enterprise Linux AI (RHEL AI), Red Hat Trusted Artifact Signer, Red Hat Streams for Apache Kafka, Vercel Next.js. Vendors: npm, Red Hat, Vercel.

Quick answers

Is CVE-2026-44577 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44577 being exploited in the wild.
How severe is CVE-2026-44577?: Medium severity, with a CVSS score of 5.9, published 13 May 2026.
Which products and versions are affected?: next (npm) SEMVER:introduced=10.0.0,fixed=15.5.16; Vercel Next.js >= 10.0.0, < 15.5.16; >= 16.0.0, < 16.2.5, 10.0.0 to < 15.5.16, 16.0.0 to < 16.2.5.
Is there a fix for CVE-2026-44577?: Yes. next (npm): upgrade to 15.5.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44577 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44577?: Check whether you run next (npm), Red Hat Enterprise Linux AI (RHEL AI), Red Hat Trusted Artifact Signer or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

next (npm): upgrade to 15.5.16 or later
```
npm install next@15.5.16
```

Technical details

A resource exhaustion vulnerability (CWE-770) exists in the Next.js Image Optimization API. When self-hosting with the default image loader, the API fetches local images entirely into memory without enforcing a maximum size limit. An unauthenticated remote attacker can exploit this by sending crafted requests to the /_next/image endpoint for large local assets that match the images.localPatterns configuration. This results in an out-of-memory (OOM) condition and a Denial of Service. The vulnerability is fixed in versions 15.5.16 and 16.2.5 by implementing consistent response size limits via the images.maximumResponseBody configuration.

Affected products

Vercel Next.js >= 10.0.0, < 15.5.16; >= 16.0.0, < 16.2.5
Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
Red Hat Red Hat Trusted Artifact Signer
Red Hat streams for Apache Kafka 2
Red Hat streams for Apache Kafka 3

Identifiers

CVE-2026-44577
GHSA-h64f-5h5j-jqjh

Timeline

2026-05-06: advisory: GitHub Advisory GHSA-h64f-5h5j-jqjh published
2026-05-13: disclosed: CVE-2026-44577 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.