# CVE-2026-64644: Vercel Next.js denial of service in Image Optimization API

Source: https://junglewise.ai/threats/cve-2026-64644-vercel-next-js-denial-of-service-in-image-optimization-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-64644 · Severity: medium · CVSS 4 · Published 2026-07-27

Next.js is a popular web development framework used to build and host websites. A vulnerability in its image processing component allows attackers to crash or slow down a website by providing specially crafted images from remote sources. This could lead to a denial-of-service (DoS) condition, making the site unavailable to legitimate users. This issue only affects self-hosted applications that have specifically enabled remote image optimization.

Technologies: [next (npm)](https://junglewise.ai/threats/technologies/npm-next), [Vercel Next.js](https://junglewise.ai/threats/technologies/next-js). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Vercel](https://junglewise.ai/threats/vendors/vercel).

## Quick answers

**Is CVE-2026-64644 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64644 being exploited in the wild.

**How severe is CVE-2026-64644?** Medium severity, with a CVSS score of 4, published 27 July 2026.

**Which products and versions are affected?** next (npm) SEMVER:introduced=15.5.0,fixed=15.5.21; Vercel Next.js >= 15.5.0, < 15.5.21; >= 16.0.0, < 16.2.11, 15.5.0 - 15.5.20, 16.0.0 - 16.2.10.

**Is there a fix for CVE-2026-64644?** Yes. next (npm): upgrade to 15.5.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-64644 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-64644?** Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- next (npm): upgrade to 15.5.21 or later

  ```sh
  npm install next@15.5.21
  ```


## Technical details

A denial of service (DoS) vulnerability exists in the Next.js Image Optimization API due to inefficient algorithmic complexity (CWE-407) when processing certain image types, specifically SVGs. When an application is configured with 'remotePatterns' to allow external image optimization, an attacker can provide a link to a malicious image that triggers excessive CPU consumption during metadata detection. The root cause was a slow fallback to 'sharp().metadata()' when content types could not be easily detected. This affects self-hosted instances using the default image loader; Vercel-hosted applications and those using custom loaders are not impacted. The issue is fixed in versions 15.5.21 and 16.2.11.

## Affected products

- Vercel Next.js 15.5.0 - 15.5.20, 16.0.0 - 16.2.10

## Identifiers

- CVE-2026-64644
- GHSA-q8wf-6r8g-63ch

## Timeline

- 2026-07-21: patched: Fixes released in versions 15.5.21 and 16.2.11
- 2026-07-21: advisory: GitHub Security Advisory GHSA-q8wf-6r8g-63ch published
- 2026-07-27: disclosed: CVE-2026-64644 published to NVD

## References

- [https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c](https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c)
- [https://github.com/vercel/next.js/pull/96006](https://github.com/vercel/next.js/pull/96006)
- [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://github.com/vercel/next.js/releases/tag/v15.5.21)
- [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://github.com/vercel/next.js/releases/tag/v16.2.11)
- [https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch](https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch)

## Related threats

- [Vercel Next.js remote code execution in use cache functions](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ac3e73d3)
- [Next.js denial of service in App Router with Server Actions](https://junglewise.ai/threats/cve-2026-94482-next-js-denial-of-service-in-app-router-using-server-actions)
- [Next.js unauthenticated remote code execution in Image Optimization API](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-image-optimization-api-f1b22a87)
- [Next.js information disclosure in Draft Mode via use cache](https://junglewise.ai/threats/cve-2026-94544-next-js-is-a-react-framework-for-building-full-stack-web)
- [Next.js Pages Router response cache key bypass](https://junglewise.ai/threats/cve-2026-94543-next-js-is-a-react-framework-for-building-full-stack-web)