CVE-2026-44577: Next.js: Denial of Service in the Image Optimization API
Impact
When self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed).
- If you are using images.localPatterns, only the patterns in that array are impacted. - If you are using images.unoptimized: true, you are NOT impacted. - If you are using images.loader: 'custom', you are NOT impacted. - If you are using Vercel, you are NOT impacted.
Fix
We now apply response size limits consistently to internal image fetches, not just external ones, and fail oversized responses before they can exhaust process memory.
This can be adjusted using the images.maximumResponseBody configuration.
Workarounds
If you cannot upgrade immediately, avoid routing large local assets through /next/image, disable image optimization for large or untrusted local files, or block image optimization access to those assets at the edge.
You can disable using the images.localPatterns: [] configuration. This will still allow fetching remote images (which is not impacted).
Other sources
Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.2.5 - Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 15.5.16 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 15.5.16 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 16.2.5 - Configuration
Set Next.js image optimization response size limits using the images.maximumResponseBody configuration to prevent oversized internal image fetches from exhausting process memory.
Next.js Image Optimization API images.maximumResponseBody = (set to a maximum response body size) - Configuration
Disable local asset pattern matching by setting images.localPatterns to [] so the /_next/image endpoint will not serve local images that could trigger out-of-memory conditions.
Next.js Image Optimization API images.localPatterns = [] - Compensating control
If you cannot upgrade immediately, avoid routing large local assets through /_next/image; disable image optimization for large or untrusted local files; or block image optimization access to those assets at the edge.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44577?
CVE-2026-44577 is classified as a high severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2026-44577?
To mitigate CVE-2026-44577, upgrade to Next.js version 16.2.5 or 15.5.16.
What does CVE-2026-44577 affect?
CVE-2026-44577 affects the Next.js framework when self-hosting with the default image loader.
What is the risk of CVE-2026-44577?
The risk associated with CVE-2026-44577 includes potential out-of-memory conditions that can lead to service outages.
Are earlier versions of Next.js affected by CVE-2026-44577?
Yes, earlier versions of Next.js prior to 15.5.16 and 16.2.5 are affected by CVE-2026-44577.