Resource exhaustion in Next.js - CVE-2026-64644
Published: July 22, 2026
Vulnerability identifier: #VU139035
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64644
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the Image Optimization API endpoint when processing remotely hosted malicious SVG images through the /_next/image endpoint. A remote attacker can supply a specially crafted SVG image to cause a denial of service.
Only self-hosted deployments using the default image loader with remote image optimization configured are vulnerable. Only configured remotePatterns are affected, and exploitation can lead to CPU exhaustion.
Affected software
Next.js
How to mitigate CVE-2026-64644
Install security update from vendor's website.
Next.js - addressed in versions 15.5.21, 16.2.11