CVE-2025-59471

Name of the Vulnerable Software and Affected Versions Next.js versions prior to 15.5.10 Next.js versions prior to 16.1.5

Description A denial of service issue exists in self-hosted Next.js applications utilizing the Image Optimizer with configured remotePatterns. The image optimization endpoint (/ next/image) loads external images completely into memory without a size restriction, potentially leading to out-of-memory conditions when processing excessively large images. Exploitation requires that remotePatterns is configured to permit image optimization from external domains and the attacker's ability to serve or control a large image on an allowed domain.

Recommendations Upgrade to Next.js version 15.5.10 or later. Upgrade to Next.js version 16.1.5 or later.