Packages / next / Security

ModerateVulnerabilityGHSA-q8wf-6r8g-63chCVE-2026-64644Published 22 Jul 2026

Next.js: Denial of Service in the Image Optimization API using SVGs

Affected releases · next

  • 16.x16.0.0 – 16.2.10Fixed in 16.2.11
  • 15.x15.5.0 – 15.5.20Fixed in 15.5.21

On 16.x, the newest line:

npm install next@16.2.11
16.x

  1. Affected

    16.0.0 – 16.2.10

    31 releases

  2. Fixed

    16.2.11 – 16.4.2

    14 releases, latest

15.x

  1. Not affected

    15.0.0 – 15.4.11

    54 releases

  2. Affected

    15.5.0 – 15.5.20

    20 releases

  3. Fixed

    15.5.21 – 15.5.28

    8 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Impact

When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints.

  • If you are using config.images.remotePatterns, only the patterns in that array are impacted.

  • If you are using config.images.unoptimized: true, you are NOT impacted.

  • If you are using config.images.loader: 'custom', you are NOT impacted.

  • If you are using Vercel, you are NOT impacted.

Workarounds

If you cannot upgrade immediately, you can avoid the expensive work by setting config.experimental.imgOptSkipMetadata : true.