PT-2026-39410 · Vercel · Next.Js

Published 2026-05-09 · Updated 2026-05-13 · CVE-2026-44577

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Next.js versions 10.0.0 through 15.5.15 Next.js versions 16.0.0 through 16.2.4

Description When self-hosting with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker can trigger out-of-memory conditions by requesting large local assets from the '/ next/image' endpoint that match the images.localPatterns configuration, which allows all patterns by default.

Recommendations Update to version 15.5.16. Update to version 16.2.5. As a temporary workaround, avoid routing large local assets through '/ next/image', disable image optimization for large or untrusted local files, or block image optimization access to those assets at the edge. Disable the affected functionality using the images.localPatterns: [] configuration. Adjust the images.maximumResponseBody configuration to apply response size limits.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-44577

GHSA-H64F-5H5J-JQJH

Affected Products

Next.Js

References · 9

• https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h64f-5h5j-jqjh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44577 · Security Note
• https://github.com/vercel/next.js/releases/tag/v15.5.16 · Note
• https://github.com/vercel/next.js/releases/tag/v16.2.5 · Note
• https://github.com/vercel/next.js · Note
• https://twitter.com/HackingTeam77/status/2053157851128807882 · Twitter Post
• https://t.me/brutsecurity/2701 · Telegram Post
• https://t.me/proxy_bar/3371 · Telegram Post