{"id":"CVE-2026-44577","state":"PUBLISHED","title":"Next.js: Denial of Service in the Image Optimization API","description":"Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.","publishedAt":"2026-05-13T17:00:02.786Z","updatedAt":"2026-08-13T12:04:26.740Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["vercel next.js"],"affected":[{"vendor":"vercel","product":"next.js","versions":[{"version":">= 10.0.0, < 15.5.16","status":"affected"},{"version":">= 16.0.0, < 16.2.5","status":"affected"}]}],"references":["https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh","https://access.redhat.com/security/cve/CVE-2026-44577","https://bugzilla.redhat.com/show_bug.cgi?id=2477194","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44577.json","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:54435"],"weaknesses":["CWE-770"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/44xxx/CVE-2026-44577.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-44577","state":"PUBLISHED","datePublished":"2026-05-13T17:00:02.786Z","dateUpdated":"2026-08-13T12:04:26.740Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-05-06T21:49:12.424Z"},"containers":{"cna":{"title":"Next.js: Denial of Service in the Image Optimization API","descriptions":[{"lang":"en","value":"Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5."}],"affected":[{"vendor":"vercel","product":"next.js","versions":[{"version":">= 10.0.0, < 15.5.16","status":"affected"},{"version":">= 16.0.0, < 16.2.5","status":"affected"}]}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh","name":"https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","lang":"en","description":"CWE-770: Allocation of Resources Without Limits or Throttling","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-05-13T17:00:02.786Z"},"source":{"advisory":"GHSA-h64f-5h5j-jqjh","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-14T18:33:40.553243Z","id":"CVE-2026-44577","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-14T18:33:46.473Z"}},{"title":"Next.js: Next.js: Denial of Service via Image Optimization API","descriptions":[{"lang":"en","value":"A flaw was found in Next.js. When self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. A remote attacker could exploit this by requesting large local assets from the /_next/image endpoint. This can lead to out-of-memory conditions, resulting in a Denial of Service (DoS) for the application."}],"affected":[{"vendor":"Red Hat","product":"Streams for Apache Kafka 2.9.4","packageName":"next","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:2.9::el9"]},{"vendor":"Red Hat","product":"Red Hat Trusted Artifact Signer 1.3","packageName":"rhtas/rekor-search-ui-rhel9","defaultStatus":"affected","versions":[{"version":"1783958622","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:trusted_artifact_signer:1.3::el9"]},{"vendor":"Red Hat","product":"Red Hat Trusted Artifact Signer 1.4","packageName":"rhtas/rekor-search-ui-rhel9","defaultStatus":"affected","versions":[{"version":"1783327185","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:trusted_artifact_signer:1.4::el9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"firefox","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"thunderbird","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"firefox","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"firefox","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"thunderbird","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"firefox","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"thunderbird","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-cuda-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-gaudi-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-rocm-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/disk-image-cuda-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"]},{"vendor":"Red Hat","product":"streams for Apache Kafka 3","packageName":"next","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:3"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-44577","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477194","name":"RHBZ#2477194","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44577.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40974","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37272","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34608","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54435","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","description":"Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-08-13T12:04:26.740Z"},"datePublic":"2026-05-13T17:00:02.786Z","solutions":[{"lang":"en","value":"RHSA-2026:40974: Red Hat Trusted Artifact Signer 1.3"},{"lang":"en","value":"RHSA-2026:37272: Red Hat Trusted Artifact Signer 1.4"},{"lang":"en","value":"RHSA-2026:34608: Streams for Apache Kafka 2.9.4"},{"lang":"en","value":"RHSA-2026:54435: Streams for Apache Kafka 3.2.1"}],"timeline":[{"lang":"en","time":"2026-05-13T18:01:35.713Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-05-13T17:00:02.786Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}