PT-2026-4816 · Vercel · Next.Js

Published 2026-01-26 · Updated 2026-02-13 · CVE-2025-59471

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Next.js versions prior to 15.5.10 Next.js versions prior to 16.1.5

Description A denial of service issue exists in self-hosted Next.js applications utilizing the Image Optimizer with configured remotePatterns. The image optimization endpoint (/ next/image) loads external images completely into memory without a size restriction, potentially leading to out-of-memory conditions when processing excessively large images. Exploitation requires that remotePatterns is configured to permit image optimization from external domains and the attacker's ability to serve or control a large image on an allowed domain.

Recommendations Upgrade to Next.js version 15.5.10 or later. Upgrade to Next.js version 16.1.5 or later.

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-409

CWE-770

CWE-400

Related Identifiers

CVE-2025-59471

GHSA-5F7Q-JPQC-WP7H

GHSA-9G9P-9GW9-JX7F

Affected Products

Next.Js

References · 18

• https://github.com/vercel/next.js/security/advisories/GHSA-9g9p-9gw9-jx7f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59471 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59472 · Security Note
• https://osv.dev/vulnerability/GHSA-5f7q-jpqc-wp7h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59471 · Security Note
• https://osv.dev/vulnerability/GHSA-9g9p-9gw9-jx7f · Vendor Advisory
• https://github.com/vercel/next.js · Note
• https://github.com/vercel/next.js/security/advisories/GHSA-5f7q-jpqc-wp7h · Note
• https://github.com/vercel/next.js/releases/tag/v16.1.5 · Note
• https://github.com/vercel/next.js/commit/e5b834d208fe0edf64aa26b5d76dcf6a176500ec · Note
• https://github.com/vercel/next.js/commit/500ec83743639addceaede95e95913398975156c · Note
• https://github.com/vercel/next.js/releases/tag/v15.5.10 · Note
• https://twitter.com/CVEnew/status/2015907305548874062 · Twitter Post
• https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 · Note
• https://twitter.com/VulmonFeeds/status/2015987445045608780 · Twitter Post