CVE-2026-64644: Vercel Next.js denial of service in Image Optimization API

CVE-2026-64644 · Severity: medium · CVSS 4 · Published 2026-07-27

Next.js is a popular web development framework used to build and host websites. A vulnerability in its image processing component allows attackers to crash or slow down a website by providing specially crafted images from remote sources. This could lead to a denial-of-service (DoS) condition, making the site unavailable to legitimate users. This issue only affects self-hosted applications that have specifically enabled remote image optimization.

Technologies: next (npm), Vercel Next.js. Vendors: npm, Vercel.

Quick answers

Is CVE-2026-64644 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-64644 being exploited in the wild.
How severe is CVE-2026-64644?
Medium severity, with a CVSS score of 4, published 27 July 2026.
Which products and versions are affected?
next (npm) SEMVER:introduced=15.5.0,fixed=15.5.21; Vercel Next.js >= 15.5.0, < 15.5.21; >= 16.0.0, < 16.2.11, 15.5.0 - 15.5.20, 16.0.0 - 16.2.10.
Is there a fix for CVE-2026-64644?
Yes. next (npm): upgrade to 15.5.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64644 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-64644?
Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • next (npm): upgrade to 15.5.21 or later
    npm install next@15.5.21

Technical details

A denial of service (DoS) vulnerability exists in the Next.js Image Optimization API due to inefficient algorithmic complexity (CWE-407) when processing certain image types, specifically SVGs. When an application is configured with 'remotePatterns' to allow external image optimization, an attacker can provide a link to a malicious image that triggers excessive CPU consumption during metadata detection. The root cause was a slow fallback to 'sharp().metadata()' when content types could not be easily detected. This affects self-hosted instances using the default image loader; Vercel-hosted applications and those using custom loaders are not impacted. The issue is fixed in versions 15.5.21 and 16.2.11.

Affected products

  • Vercel Next.js 15.5.0 - 15.5.20, 16.0.0 - 16.2.10

Identifiers

  • CVE-2026-64644
  • GHSA-q8wf-6r8g-63ch

Timeline

  • 2026-07-21: patched: Fixes released in versions 15.5.21 and 16.2.11
  • 2026-07-21: advisory: GitHub Security Advisory GHSA-q8wf-6r8g-63ch published
  • 2026-07-27: disclosed: CVE-2026-64644 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.