CVE-2026-64644
Received Received - Intake

CPU Exhaustion in Next.js Image Optimization API

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: GitHub, Inc.

Description
Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints.Only config.images.remotePatterns is affected, and just the patterns in that array, whereas config.images.unoptimized: true, config.images.loader: 'custom', and Vercel are not impacted. This issue has been fixed in versions 15.5.21 and 16.2.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-64644
EUVD
EUVD-2026-49388

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
vercel next.js From 15.5.0 (inc) to 15.5.20 (inc)
vercel next.js From 16.0.0 (inc) to 16.2.10 (inc)
vercel next.js 15.5.21
vercel next.js 16.2.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-64644 is a Denial of Service (DoS) vulnerability in Next.js's Image Optimization API affecting versions 15.5.0-15.5.20 and 16.0.0-16.2.10. When self-hosting with default image loader and remotePatterns configured, malicious SVG images can cause CPU exhaustion in /_next/image endpoints by triggering slow content-type detection fallback methods.

Detection Guidance

To detect this vulnerability, check if your Next.js application is running versions 15.5.0 through 15.5.20 or 16.0.0 through 16.2.10. Verify if config.images.remotePatterns is configured for remote image optimization. Monitor CPU usage on /_next/image endpoints for unusual spikes, especially when processing SVG images.

Impact Analysis

This vulnerability can disrupt your Next.js application by consuming excessive CPU resources when processing malicious images. It requires network access but no privileges or user interaction. Impacted users will experience degraded performance or complete service unavailability during attacks.

Compliance Impact

This vulnerability primarily impacts system availability due to CPU exhaustion from malicious image optimization requests. It does not directly involve data breaches or unauthorized access, which are key concerns for GDPR or HIPAA. However, prolonged service disruption could indirectly affect compliance by impairing systems handling sensitive data.

Mitigation Strategies

Immediately upgrade Next.js to versions 15.5.21 or 16.2.11 or later. As a temporary workaround, set config.experimental.imgOptSkipMetadata to true until the upgrade is completed. Disable remote image optimization by removing or restricting config.images.remotePatterns if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64644. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart