Junglewise Threat Intelligence

CVE-2026-64644: Vercel Next.js denial of service in Image Optimization API

CVE-2026-64644 · Severity: medium · CVSS 4 · Published 2026-07-27

Technologies: Vercel Next.js. Vendors: Vercel.

Executive brief

Next.js is a popular web development framework used to build and host websites. A vulnerability in its image processing component allows attackers to crash or slow down a website by providing specially crafted images from remote sources. This could lead to a denial-of-service (DoS) condition, making the site unavailable to legitimate users. This issue only affects self-hosted applications that have specifically enabled remote image optimization.

Technical details

A denial of service (DoS) vulnerability exists in the Next.js Image Optimization API due to inefficient algorithmic complexity (CWE-407) when processing certain image types, specifically SVGs. When an application is configured with 'remotePatterns' to allow external image optimization, an attacker can provide a link to a malicious image that triggers excessive CPU consumption during metadata detection. The root cause was a slow fallback to 'sharp().metadata()' when content types could not be easily detected. This affects self-hosted instances using the default image loader; Vercel-hosted applications and those using custom loaders are not impacted. The issue is fixed in versions 15.5.21 and 16.2.11.

Affected products

  • Vercel Next.js 15.5.0 - 15.5.20, 16.0.0 - 16.2.10

Timeline

  • 2026-07-21: patched: Fixes released in versions 15.5.21 and 16.2.11
  • 2026-07-21: advisory: GitHub Security Advisory GHSA-q8wf-6r8g-63ch published
  • 2026-07-27: disclosed: CVE-2026-64644 published to NVD

References

Related threats