A flaw in Next.js’s Image Optimization API allows unbounded loading of local images into memory, which can exhaust available system memory and cause the application to become unavailable. The weakness is a resource exhaustion flaw (CWE‑770) that results in a denial‑of‑service condition when large images are requested through the "/_next/image" endpoint.

Self‑hosted Next.js installations produced by Vercel, running versions 10.0.0 through 15.5.15 and 16.2.4 that use the default image loader, are affected. The vulnerability is triggered when the request matches the images.localPatterns setting, which by default permits all patterns. The issue is resolved in Next.js versions 15.5.16 and 16.2.5 and later.

The CVSS score of 5.9 indicates a medium severity. It is inferred from the description that an attacker can issue requests to the application’s "/_next/image" endpoint to trigger out‑of‑memory crashes; no authentication is required. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, it is not yet known to be widely exploited, but the impact of service disruption justifies prompt remediation.