CVE-2026-44577 is a resource allocation vulnerability (CWE-770) affecting Next.js, a React framework for full-stack web applications. Specifically, in versions >=10.0.0 <15.5.16 and >=16.0.0 <16.2.5, the default image loader's Image Optimization API fetches local images fully into memory without limiting their size. An attacker can exploit this by requesting large local images matching the images.localPatterns configuration, potentially causing out-of-memory conditions on the host. The vulnerability is addressed in Next.js versions 15.5.16 and 16.2.5. The CVSS v3.1 base score is 5.9 (medium severity), reflecting network attack vector, high attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service). The vendor advisory from Red Hat confirms the vulnerability and the fixed versions but does not explicitly state patch availability beyond the fixed versions.

Successful exploitation allows an attacker to cause out-of-memory conditions on the server hosting Next.js by requesting large local images through the Image Optimization API. This results in denial of service due to resource exhaustion. There is no impact on confidentiality or integrity reported.

The vulnerability is fixed in Next.js versions 15.5.16 and 16.2.5. Users should upgrade to these or later versions to remediate the issue. Patch status is not explicitly stated in the vendor advisory, but the fixed versions are known. No additional mitigation steps are indicated by the vendor advisory.