CoreCVE
Back

HIGH

Next.js: Denial of Service in the Image Optimization API

Published May 13, 2026

Description

Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.

Affected products

Remediation

Red Hat statement

This Important flaw in Next.js affects self-hosted applications utilizing the default image loader. A remote attacker can trigger a denial of service by requesting large local image assets, leading to out-of-memory conditions. This vulnerability is present when `images.localPatterns` is configured to allow all patterns by default, and is not applicable when using Vercel, a custom image loader, or `images.unoptimized: true`.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-770

Allocation of Resources Without Limits

References (13)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published May 13, 2026
Updated Aug 13, 2026
Reserved May 6, 2026
Link CVE-2026-44577
CISA Vulnrichment
Updated May 14, 2026
NVD
Status Modified
Modified Aug 13, 2026
Link CVE-2026-44577
Red Hat
Severity Important
Public date May 13, 2026
Links CVE-2026-44577 - Bugzilla
GHSA-H64F-5H5J-JQJH