Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-05-13T17:00:02 Next.js: Next.js: Denial of Service via Image Optimization API 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.

A flaw was found in Next.js. When self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. A remote attacker could exploit this by requesting large local assets from the /_next/image endpoint. This can lead to out-of-memory conditions, resulting in a Denial of Service (DoS) for the application.

This Important flaw in Next.js affects self-hosted applications utilizing the default image loader. A remote attacker can trigger a denial of service by requesting large local image assets, leading to out-of-memory conditions. This vulnerability is present when `images.localPatterns` is configured to allow all patterns by default, and is not applicable when using Vercel, a custom image loader, or `images.unoptimized: true`. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Streams for Apache Kafka 2.9.4 2026-07-02T00:00:00Z RHSA-2026:34608 next Red Hat Trusted Artifact Signer 1.3 2026-07-16T00:00:00Z RHSA-2026:40974 rhtas/rekor-search-ui-rhel9:1783958622 Red Hat Trusted Artifact Signer 1.4 2026-07-09T00:00:00Z RHSA-2026:37272 rhtas/rekor-search-ui-rhel9:1783327185 Red Hat Enterprise Linux 10 Not affected firefox Red Hat Enterprise Linux 10 Not affected thunderbird Red Hat Enterprise Linux 7 Not affected firefox Red Hat Enterprise Linux 8 Not affected firefox Red Hat Enterprise Linux 8 Not affected thunderbird Red Hat Enterprise Linux 9 Not affected firefox Red Hat Enterprise Linux 9 Not affected thunderbird Red Hat Enterprise Linux AI (RHEL AI) 3 Will not fix rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Will not fix rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Will not fix rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Will not fix rhelai3/disk-image-cuda-rhel9 streams for Apache Kafka 3 Affected next https://www.cve.org/CVERecord?id=CVE-2026-44577 https://nvd.nist.gov/vuln/detail/CVE-2026-44577 https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh