# CVE-2026-44577: Vercel Next.js denial of service in Image Optimization API

Source: https://junglewise.ai/threats/cve-2026-44577-vercel-next-js-denial-of-service-in-image-optimization-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-44577 · Severity: medium · CVSS 5.9 · Published 2026-05-13

Next.js is a popular framework used to build and host web applications. A vulnerability in its image processing component allows an attacker to crash the web server by requesting very large images, leading to a service outage. This issue primarily affects organizations that self-host their Next.js applications rather than using the Vercel platform.

Technologies: [next (npm)](https://junglewise.ai/threats/technologies/npm-next), [Red Hat Enterprise Linux AI (RHEL AI)](https://junglewise.ai/threats/technologies/enterprise-linux-ai-3), [Red Hat Trusted Artifact Signer](https://junglewise.ai/threats/technologies/trusted-artifact-signer), [Red Hat Streams for Apache Kafka](https://junglewise.ai/threats/technologies/streams-for-apache-kafka), [Vercel Next.js](https://junglewise.ai/threats/technologies/next-js). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Red Hat](https://junglewise.ai/threats/vendors/red-hat), [Vercel](https://junglewise.ai/threats/vendors/vercel).

## Quick answers

**Is CVE-2026-44577 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44577 being exploited in the wild.

**How severe is CVE-2026-44577?** Medium severity, with a CVSS score of 5.9, published 13 May 2026.

**Which products and versions are affected?** next (npm) SEMVER:introduced=10.0.0,fixed=15.5.16; Vercel Next.js >= 10.0.0, < 15.5.16; >= 16.0.0, < 16.2.5, 10.0.0 to < 15.5.16, 16.0.0 to < 16.2.5.

**Is there a fix for CVE-2026-44577?** Yes. next (npm): upgrade to 15.5.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44577 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44577?** Check whether you run next (npm), Red Hat Enterprise Linux AI (RHEL AI), Red Hat Trusted Artifact Signer or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- next (npm): upgrade to 15.5.16 or later

  ```sh
  npm install next@15.5.16
  ```


## Technical details

A resource exhaustion vulnerability (CWE-770) exists in the Next.js Image Optimization API. When self-hosting with the default image loader, the API fetches local images entirely into memory without enforcing a maximum size limit. An unauthenticated remote attacker can exploit this by sending crafted requests to the /_next/image endpoint for large local assets that match the images.localPatterns configuration. This results in an out-of-memory (OOM) condition and a Denial of Service. The vulnerability is fixed in versions 15.5.16 and 16.2.5 by implementing consistent response size limits via the images.maximumResponseBody configuration.

## Affected products

- Vercel Next.js >= 10.0.0, < 15.5.16; >= 16.0.0, < 16.2.5
- Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Red Hat Trusted Artifact Signer
- Red Hat streams for Apache Kafka 2
- Red Hat streams for Apache Kafka 3

## Identifiers

- CVE-2026-44577
- GHSA-h64f-5h5j-jqjh

## Timeline

- 2026-05-06: advisory: GitHub Advisory GHSA-h64f-5h5j-jqjh published
- 2026-05-13: disclosed: CVE-2026-44577 published to NVD

## References

- [https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh](https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh)
- [https://access.redhat.com/security/cve/CVE-2026-44577](https://access.redhat.com/security/cve/CVE-2026-44577)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2477194](https://bugzilla.redhat.com/show_bug.cgi?id=2477194)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44577.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44577.json)

## Related threats

- [Vercel Next.js remote code execution in use cache functions](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ac3e73d3)
- [Next.js denial of service in App Router with Server Actions](https://junglewise.ai/threats/cve-2026-94482-next-js-denial-of-service-in-app-router-using-server-actions)
- [Next.js unauthenticated remote code execution in Image Optimization API](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-image-optimization-api-f1b22a87)
- [Next.js information disclosure in Draft Mode via use cache](https://junglewise.ai/threats/cve-2026-94544-next-js-is-a-react-framework-for-building-full-stack-web)
- [Next.js Pages Router response cache key bypass](https://junglewise.ai/threats/cve-2026-94543-next-js-is-a-react-framework-for-building-full-stack-web)