Next.js: Denial of Service in the Image Optimization API using SVGs
### Impact When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in `/_next/image` endpoints. - If you are using `config.images.remotePatterns`, only the patterns in that array are impacted. - If you are using `config.images.unoptimized: true`, you are NOT impacted. - If you are using `config.images.loader: 'custom'`, you are NOT impacted. - If you are using Vercel, you are NOT impacted. ### Workarounds If you cannot upgrade immediately, you can avoid the expensive work by setting `config.experimental.imgOptSkipMetadata : true`.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-64644US | medium5.3 | — | ||
Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default ima… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/vercel/next.jsPACKAGE
- https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766cWEB
- https://github.com/vercel/next.js/pull/96006WEB
- https://github.com/vercel/next.js/releases/tag/v15.5.21WEB
- https://github.com/vercel/next.js/releases/tag/v16.2.11WEB
- https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63chWEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan