REDHAT-BUG-2477194: High severity Next.js vulnerability

Q: Which deployments are exposed to this issue?

Self-hosted Next.js deployments using the default image loader are affected if they run versions from 10.0.0 through versions before 15.5.16 or 16.2.5. The Image Optimization API is the affected component.

Q: What does an attacker need to do to trigger the condition?

An attacker must request a large local asset through the /_next/image endpoint. The asset must match images.localPatterns; by default, all patterns are allowed.

Q: Are default settings affected?

Yes. The default image loader is affected, and the default images.localPatterns behavior allows all patterns, so large local assets may be requested unless the configuration has been restricted.

Q: What is the impact of exploitation?

The Image Optimization API loads matching local images entirely into memory without a maximum size limit. Requests for large assets can exhaust memory and cause out-of-memory conditions.

Q: What versions contain the fix?

The issue is fixed in Next.js 15.5.16 and 16.2.5.

Published May 13, 2026

Updated

Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.

Affected Software

1 affected component

Next.js>=10.0.0<15.5.16, >15.5.16<=16.2.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.5.16
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.2.5

Event History

May 13, 2026

Data Sourced

via Red Hat·06:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Self-hosted Next.js deployments using the default image loader are affected if they run versions from 10.0.0 through versions before 15.5.16 or 16.2.5. The Image Optimization API is the affected component.

What does an attacker need to do to trigger the condition?

An attacker must request a large local asset through the /_next/image endpoint. The asset must match images.localPatterns; by default, all patterns are allowed.

Are default settings affected?

Yes. The default image loader is affected, and the default images.localPatterns behavior allows all patterns, so large local assets may be requested unless the configuration has been restricted.

What is the impact of exploitation?

The Image Optimization API loads matching local images entirely into memory without a maximum size limit. Requests for large assets can exhaust memory and cause out-of-memory conditions.

What versions contain the fix?

The issue is fixed in Next.js 15.5.16 and 16.2.5.

REDHAT-BUG-2477194: High severity Next.js vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the condition?

Are default settings affected?

What is the impact of exploitation?

What versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the condition?

Are default settings affected?

What is the impact of exploitation?

What versions contain the fix?