CVE-2026-44577: Next.js: Denial of Service in the Image Optimization API

Published May 11, 2026
·
Updated

Impact

When self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed).

- If you are using images.localPatterns, only the patterns in that array are impacted. - If you are using images.unoptimized: true, you are NOT impacted. - If you are using images.loader: 'custom', you are NOT impacted. - If you are using Vercel, you are NOT impacted.

Fix

We now apply response size limits consistently to internal image fetches, not just external ones, and fail oversized responses before they can exhaust process memory.

This can be adjusted using the images.maximumResponseBody configuration.

Workarounds

If you cannot upgrade immediately, avoid routing large local assets through /next/image, disable image optimization for large or untrusted local files, or block image optimization access to those assets at the edge.

You can disable using the images.localPatterns: [] configuration. This will still allow fetching remote images (which is not impacted).

Other sources

Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.

MITRE

Affected Software

4 affected componentsFixes available
npm/next>=16.0.0<16.2.5
16.2.5
npm/next>=10.0.0<15.5.16
15.5.16
Vercel Next.js Node.js>=10.0.0<15.5.16
Vercel Next.js Node.js>=16.0.0<16.2.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade npm/next to a version that resolves this vulnerability.

    Fixed in 16.2.5
  2. Upgrade

    Upgrade npm/next to a version that resolves this vulnerability.

    Fixed in 15.5.16
  3. Upgrade

    Upgrade Next.js to a version that resolves this vulnerability.

    Fixed in 15.5.16
  4. Upgrade

    Upgrade Next.js to a version that resolves this vulnerability.

    Fixed in 16.2.5
  5. Configuration

    Set Next.js image optimization response size limits using the images.maximumResponseBody configuration to prevent oversized internal image fetches from exhausting process memory.

    Next.js Image Optimization API images.maximumResponseBody = (set to a maximum response body size)
  6. Configuration

    Disable local asset pattern matching by setting images.localPatterns to [] so the /_next/image endpoint will not serve local images that could trigger out-of-memory conditions.

    Next.js Image Optimization API images.localPatterns = []
  7. Compensating control

    If you cannot upgrade immediately, avoid routing large local assets through /_next/image; disable image optimization for large or untrusted local files; or block image optimization access to those assets at the edge.

Event History

May 11, 2026
Advisory Published
via GitHub·03:56 PM
Data Sourced
via GitHub·03:56 PM
DescriptionSeverityWeaknessAffected Software
May 13, 2026
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeaknessAffected Software
Data Sourced
via Red Hat·06:01 PM
DescriptionSeverityAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-44577?

CVE-2026-44577 is classified as a high severity vulnerability due to its potential to cause denial of service.

2

How do I fix CVE-2026-44577?

To mitigate CVE-2026-44577, upgrade to Next.js version 16.2.5 or 15.5.16.

3

What does CVE-2026-44577 affect?

CVE-2026-44577 affects the Next.js framework when self-hosting with the default image loader.

4

What is the risk of CVE-2026-44577?

The risk associated with CVE-2026-44577 includes potential out-of-memory conditions that can lead to service outages.

5

Are earlier versions of Next.js affected by CVE-2026-44577?

Yes, earlier versions of Next.js prior to 15.5.16 and 16.2.5 are affected by CVE-2026-44577.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203