CVE-2026-64644 in Next.js
Summary
by MITRE • 07/27/2026
Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints.Only config.images.remotePatterns is affected, and just the patterns in that array, whereas config.images.unoptimized: true, config.images.loader: 'custom', and Vercel are not impacted. This issue has been fixed in versions 15.5.21 and 16.2.11.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability described represents a critical security flaw in Next.js framework versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10 that specifically affects the Image Optimization API when configured with remote patterns. This issue falls under the category of resource exhaustion attacks as defined by CWE-400, where maliciously crafted images can cause significant CPU consumption in the application's image processing endpoints. The vulnerability stems from the default configuration allowing remote image optimization without proper validation of source content, creating a pathway for attackers to exploit the system's processing capabilities through carefully constructed image files that consume disproportionate computational resources during the optimization process.
The technical implementation of this flaw occurs when developers configure the next.config.js file with remotePatterns in the images configuration section, enabling the framework to fetch and optimize images from external sources. The vulnerability specifically targets the /_next/image endpoint which handles image optimization requests, where the framework attempts to process images from remote origins specified in the remotePatterns array. When these remote images contain malicious content designed to trigger excessive processing requirements, the system's CPU resources become consumed at an abnormal rate, potentially leading to denial of service conditions that can impact application availability and performance for legitimate users.
The operational impact of this vulnerability extends beyond simple performance degradation to encompass potential system instability and resource exhaustion attacks that can affect entire application deployments. Attackers exploiting this vulnerability can cause sustained high CPU usage through repeated requests to the image optimization endpoints, potentially leading to application crashes or unavailability during peak processing times. The vulnerability affects only specific configurations where remotePatterns are explicitly defined, meaning that developers who have set config.images.unoptimized: true, config.images.loader: 'custom', or are using Vercel's hosted solution remain unaffected by this particular issue.
Security mitigations for this vulnerability involve upgrading to the patched versions 15.5.21 and 16.2.11 where the framework properly validates remote image content before processing. Organizations should also implement additional configuration controls such as limiting the number of concurrent image optimization requests, implementing rate limiting on image endpoints, and monitoring CPU usage patterns for unusual spikes that might indicate exploitation attempts. The fix addresses the root cause by ensuring that when remotePatterns are configured, the system performs proper validation of remote content to prevent maliciously crafted images from triggering excessive resource consumption during the optimization process, thereby protecting against both accidental and intentional resource exhaustion attacks.
From an ATT&CK framework perspective, this vulnerability maps to TA0043 (Resource Exhaustion) and T1499.004 (Endpoint Resource Exhaustion), where attackers leverage legitimate application functionality to consume system resources beyond normal operational limits. The attack surface is reduced for organizations that do not configure remotePatterns or use alternative image loading strategies, which aligns with the principle of least privilege and secure configuration management practices recommended in cybersecurity frameworks. This vulnerability demonstrates the importance of validating external inputs and implementing proper resource limits even for features that appear benign, as the default behavior of enabling remote image optimization can create unexpected security risks when combined with malicious content from untrusted sources.