UNKNOWN npm
Next.js: Denial of Service in the Image Optimization API using SVGs
GHSA-q8wf-6r8g-63ch · CVE-2026-64644
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints.
- If you are using
config.images.remotePatterns, only the patterns in that array are impacted. - If you are using
config.images.unoptimized: true, you are NOT impacted. - If you are using
config.images.loader: 'custom', you are NOT impacted. - If you are using Vercel, you are NOT impacted.
Workarounds
If you cannot upgrade immediately, you can avoid the expensive work by setting config.experimental.imgOptSkipMetadata : true.
References
- WEB https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch
- WEB https://github.com/vercel/next.js/pull/96006
- WEB https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c
- PACKAGE https://github.com/vercel/next.js
- WEB https://github.com/vercel/next.js/releases/tag/v15.5.21
- WEB https://github.com/vercel/next.js/releases/tag/v16.2.11
Ready to move
Start Securing
Free, no credit card | First findings in minutes