CVE-2026-64644 - Vulnerability Details

- Next.js: Denial of Service in the Image Optimization API using SVGs

Description

Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints.Only config.images.remotePatterns is affected, and just the patterns in that array, whereas config.images.unoptimized: true, config.images.loader: 'custom', and Vercel are not impacted. This issue has been fixed in versions 15.5.21 and 16.2.11.

Published: 2026-07-27

Score: 6.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The CVE describes that the Image Optimization API of Next.js can cause CPU exhaustion when processing malicious SVG images, resulting in a denial‑of‑service. This resource‑exhaustion weakness is identified as CWE‑407. Attacks would exhaust system processing capacity, potentially taking the image optimization endpoint and related services offline.

Affected Systems

Vercel Next.js versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10 are affected when the default image loader is used and config.images.remotePatterns is configured. The vulnerability does not impact sites that set config.images.unoptimized to true, use a custom loader, or host images on Vercel's own infrastructure.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity. The EPSS score is < 1%, indicating a very low exploitation probability. The issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an application that trusts remote image URLs defined in config.images.remotePatterns; an attacker can host a crafted SVG file that, when requested through the /_next/image endpoint, will trigger CPU exhaustion and disrupt service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

vercel

next.js

affected

Version	Status	Constraints
`>= 15.5.0, < 15.5.21`	affected	—
`>= 16.0.0, < 16.2.11`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:vercel:next.js::::::node.js::*
	cpe:2.3:a:vercel:next.js::::::node.js::*

No data.

Vendor Product Confidence Versions

Vercel

Next.js

100%

Version	Status	Scheme	Platform
`[15.5.0,15.5.21)`	affected	semver	—
`[16.0.0,16.2.11)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Next.js to version 15.5.21 or later, or 16.2.11 or later, to apply the vendor‑provided fix.
If an upgrade is not immediately possible, remove or disable remotePatterns in the image configuration so the vulnerable loader is never invoked.
As a temporary mitigation, restrict access to the /_next/image endpoint to trusted clients or apply rate limiting to reduce the impact of potential CPU exhaustion attacks.

Generated by OpenCVE AI on August 3, 2026 at 17:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Github GHSA	GHSA-q8wf-6r8g-63ch	Next.js: Denial of Service in the Image Optimization API using SVGs

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00675.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c
https://github.com/vercel/next.js/pull/96006
https://github.com/vercel/next.js/releases/tag/v15.5.21
https://github.com/vercel/next.js/releases/tag/v16.2.11
https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch
https://nvd.nist.gov/vuln/detail/CVE-2026-64644
https://www.cve.org/CVERecord?id=CVE-2026-64644

History

Wed, 29 Jul 2026 08:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 29 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-770
References		https://nvd.nist.gov/vuln/detail/CVE-2026-64644 https://www.cve.org/CVERecord?id=CVE-2026-64644
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Tue, 28 Jul 2026 03:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Vercel Vercel next.js
Vendors & Products		Vercel Vercel next.js

Mon, 27 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description		Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints.Only config.images.remotePatterns is affected, and just the patterns in that array, whereas config.images.unoptimized: true, config.images.loader: 'custom', and Vercel are not impacted. This issue has been fixed in versions 15.5.21 and 16.2.11.
Title		Next.js: Denial of Service in the Image Optimization API using SVGs
Weaknesses		CWE-407
References		https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c https://github.com/vercel/next.js/pull/96006 https://github.com/vercel/next.js/releases/tag/v15.5.21 https://github.com/vercel/next.js/releases/tag/v16.2.11 https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch
Metrics		cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`

Subscriptions

Vercel Next.js

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-07-27T17:54:52.530Z

Updated: 2026-07-27T18:35:41.443Z

Reserved: 2026-07-20T17:11:30.895Z

Link: CVE-2026-64644

Vulnrichment

Updated: 2026-07-27T18:35:38.079Z

NVD

Status : Analyzed

Published: 2026-07-27T18:16:59.307

Modified: 2026-07-29T14:39:23.520

Link: CVE-2026-64644

Redhat

Severity : Important

Publid Date: 2026-07-27T17:54:52Z

Links: CVE-2026-64644 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T17:15:12Z

Weaknesses

CWE-407
Inefficient Algorithmic Complexity
CWE-770
Allocation of Resources Without Limits or Throttling

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object