CVE-2026-64644

Name of the Vulnerable Software and Affected Versions Next.js versions 15.5.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10

Description When self-hosting with the default image loader, the Image Optimization API can optimize remotely hosted images if configured. Malicious content within these images can lead to CPU exhaustion at the / next/image endpoint. This issue specifically affects the config.images.remotePatterns configuration. It does not impact Vercel, the config.images.loader: 'custom' setting, or when config.images.unoptimized is set to true.

Recommendations Update Next.js versions 15.5.0 through 15.5.20 to version 15.5.21. Update Next.js versions 16.0.0 through 16.2.10 to version 16.2.11. As a temporary workaround, set config.experimental.imgOptSkipMetadata to true to avoid expensive processing.