PT-2026-63559 · Npm · Next

CVE-2026-64644 · Published 2026-07-22 · Updated 2026-07-22

OSV

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Impact

When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in / next/image endpoints.

• If you are using config.images.remotePatterns, only the patterns in that array are impacted.
• If you are using config.images.unoptimized: true, you are NOT impacted.
• If you are using config.images.loader: 'custom', you are NOT impacted.
• If you are using Vercel, you are NOT impacted.

Workarounds

If you cannot upgrade immediately, you can avoid the expensive work by setting config.experimental.imgOptSkipMetadata : true.

Fix

Weakness Enumeration

CWE-407

Related Identifiers

CVE-2026-64644

GHSA-Q8WF-6R8G-63CH

Affected Products

Next

References · 7

• https://osv.dev/vulnerability/GHSA-q8wf-6r8g-63ch · Vendor Advisory
• https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c · Note
• https://github.com/vercel/next.js/releases/tag/v16.2.11 · Note
• https://github.com/vercel/next.js · Note
• https://github.com/vercel/next.js/pull/96006 · Note
• https://github.com/vercel/next.js/releases/tag/v15.5.21 · Note
• https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch · Note