~ / search / GHSA-q8wf-6r8g-63ch

GHSA-q8wf-6r8g-63ch

Next.js: Denial of Service in the Image Optimization API using SVGs

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-64644

Packages

EcosystemPackageAffectedFixed in
npm next >= 15.5.0, < 15.5.21 15.5.21
npm next >= 16.0.0, < 16.2.11 16.2.11

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in `/_next/image` endpoints. - If you are using `config.images.remotePatterns`, only the patterns in that array are impacted. - If you are using `config.images.unoptimized: true`, you are NOT impacted. - If you are using `config.images.loader: 'custom'`, you are NOT impacted. - If you are using Vercel, you are NOT impacted. ### Workarounds If you cannot upgrade immediately, you can avoid the expensive work by setting `config.experimental.imgOptSkipMetadata : true`.

References

External links from the advisory. They lead to third-party sites.