REDHAT-BUG-2448509: Medium severity npm/next vulnerability
Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (/next/image) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. This is fixed in version 16.1.7 by adding an LRU-backed disk cache with images.maximumDiskCacheSize, including eviction of least-recently-used entries when the limit is exceeded. Setting maximumDiskCacheSize: 0 disables disk caching. If upgrading is not immediately possible, periodically clean .next/cache/images and/or reduce variant cardinality (e.g., tighten values for images.localPatterns, images.remotePatterns, and images.qualities).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Next.js image optimization disk cache (/_next/image)to a version that resolves this vulnerability.Fixed in 16.1.7 - Configuration
Set images.maximumDiskCacheSize: 0 in Next.js config to disable the disk cache for /_next/image and prevent unbounded disk growth in versions 10.0.0 through <16.1.7.
Next.js Image Optimization images.maximumDiskCacheSize = 0 - Operational
If upgrading is not immediately possible, periodically clean .next/cache/images and reduce variant cardinality by tightening values for images.localPatterns, images.remotePatterns, and images.qualities (for Next.js versions 10.0.0 through <16.1.7).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2448509?
The severity of REDHAT-BUG-2448509 is medium with a score of 4.
How do I fix REDHAT-BUG-2448509?
To fix REDHAT-BUG-2448509, update your Next.js version to 16.1.7 or later.
What versions are affected by REDHAT-BUG-2448509?
Next.js versions from 10.0.0 up to, but not including, 16.1.7 are affected by REDHAT-BUG-2448509.
What is the vulnerability in REDHAT-BUG-2448509?
The vulnerability in REDHAT-BUG-2448509 involves an unbounded cache growth in the default Next.js image optimization disk cache.
Can REDHAT-BUG-2448509 be exploited by an attacker?
Yes, an attacker could exploit REDHAT-BUG-2448509 by generating many requests to cause excessive disk space usage.