Executive brief
Next.js is a popular web development framework used to build and host websites. A vulnerability in its image processing component allows attackers to crash or slow down a website by providing specially crafted images from remote sources. This could lead to a denial-of-service (DoS) condition, making the site unavailable to legitimate users. This issue only affects self-hosted applications that have specifically enabled remote image optimization.
Technical details
A denial of service (DoS) vulnerability exists in the Next.js Image Optimization API due to inefficient algorithmic complexity (CWE-407) when processing certain image types, specifically SVGs. When an application is configured with 'remotePatterns' to allow external image optimization, an attacker can provide a link to a malicious image that triggers excessive CPU consumption during metadata detection. The root cause was a slow fallback to 'sharp().metadata()' when content types could not be easily detected. This affects self-hosted instances using the default image loader; Vercel-hosted applications and those using custom loaders are not impacted. The issue is fixed in versions 15.5.21 and 16.2.11.
Affected products
- Vercel Next.js 15.5.0 - 15.5.20, 16.0.0 - 16.2.10
Timeline
- 2026-07-21: patched: Fixes released in versions 15.5.21 and 16.2.11
- 2026-07-21: advisory: GitHub Security Advisory GHSA-q8wf-6r8g-63ch published
- 2026-07-27: disclosed: CVE-2026-64644 published to NVD
References
- https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c
- https://github.com/vercel/next.js/pull/96006
- https://github.com/vercel/next.js/releases/tag/v15.5.21
- https://github.com/vercel/next.js/releases/tag/v16.2.11
- https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch