MediumGHSA-q8wf-6r8g-63chCVE-2026-64644
Next.js: Denial of Service in the Image Optimization API using SVGs
Published 22 Jul 2026 · Updated 10 Sept 2026
Affected packages
nextnpm
- Affected
- >=15.5.0 <15.5.21
- Fixed in
- 15.5.21
Update to the fixed version for your release line, for example:
npm install next@15.5.21nextnpm
- Affected
- >=16.0.0 <16.2.11
- Fixed in
- 16.2.11
Update to the fixed version for your release line, for example:
npm install next@16.2.11Details
Impact
When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints.
- If you are using
config.images.remotePatterns, only the patterns in that array are impacted. - If you are using
config.images.unoptimized: true, you are NOT impacted. - If you are using
config.images.loader: 'custom', you are NOT impacted. - If you are using Vercel, you are NOT impacted.
Workarounds
If you cannot upgrade immediately, you can avoid the expensive work by setting config.experimental.imgOptSkipMetadata : true.
Is GHSA-q8wf-6r8g-63ch in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected next, and gives you the command that fixes it.
References
- Linkgithub.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch
- Linkgithub.com/vercel/next.js/pull/96006
- Linkgithub.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c
- Packagegithub.com/vercel/next.js
- Linkgithub.com/vercel/next.js/releases/tag/v15.5.21
- Linkgithub.com/vercel/next.js/releases/tag/v16.2.11
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.