CVE-2026-64644: Next.js: Denial of Service in the Image Optimization API using SVGs
Impact
When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /next/image endpoints.
- If you are using config.images.remotePatterns, only the patterns in that array are impacted. - If you are using config.images.unoptimized: true, you are NOT impacted. - If you are using config.images.loader: 'custom', you are NOT impacted. - If you are using Vercel, you are NOT impacted.
Workarounds
If you cannot upgrade immediately, you can avoid the expensive work by setting config.experimental.imgOptSkipMetadata : true.
Other sources
Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /next/image endpoints.Only config.images.remotePatterns is affected, and just the patterns in that array, whereas config.images.unoptimized: true, config.images.loader: 'custom', and Vercel are not impacted. This issue has been fixed in versions 15.5.21 and 16.2.11.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.2.11 - Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 15.5.21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.5.21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.2.11 - Configuration
If you cannot upgrade immediately, set config.experimental.imgOptSkipMetadata: true to skip expensive metadata work.
Next.js Image Optimization API config.experimental.imgOptSkipMetadata = true
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64644?
The severity of CVE-2026-64644 is rated as risk 26.
How can I fix CVE-2026-64644?
To mitigate CVE-2026-64644, do not enable the remote optimization feature of the Image Optimization API in Next.js.
What impact does CVE-2026-64644 have on Next.js applications?
CVE-2026-64644 can lead to CPU exhaustion by allowing the optimization of maliciously crafted images if the feature is enabled.
Is the remote image optimization feature enabled by default in Next.js?
No, the remote image optimization feature is not enabled by default in Next.js.
What version of Next.js is affected by CVE-2026-64644?
CVE-2026-64644 affects Next.js applications that use the default image loader and have remote image optimization configured.