PT-2026-63559 · Npm · Next

CVE-2026-64644 · Publicado 2026-07-22 · Atualizado 2026-07-22

OSV

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Impact

When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in / next/image endpoints.

• If you are using config.images.remotePatterns, only the patterns in that array are impacted.
• If you are using config.images.unoptimized: true, you are NOT impacted.
• If you are using config.images.loader: 'custom', you are NOT impacted.
• If you are using Vercel, you are NOT impacted.

Workarounds

If you cannot upgrade immediately, you can avoid the expensive work by setting config.experimental.imgOptSkipMetadata : true.

Correção

Enumeração de Fraquezas

CWE-407

Identificadores relacionados

CVE-2026-64644

GHSA-Q8WF-6R8G-63CH

Produtos afetados

Next

Referências · 7

• https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c · Nota
• https://github.com/vercel/next.js/releases/tag/v16.2.11 · Nota
• https://github.com/vercel/next.js · Nota
• https://github.com/vercel/next.js/pull/96006 · Nota
• https://github.com/vercel/next.js/releases/tag/v15.5.21 · Nota
• https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch · Nota
• https://osv.dev/vulnerability/GHSA-q8wf-6r8g-63ch · Aviso do Fabricante