Next.js versions >=10.0.0 <15.5.16 and >=16.0.0 <16.2.5 contain a resource allocation vulnerability (CWE-770) in the Image Optimization API when self-hosted with the default image loader. The API fetches local images entirely into memory without a maximum size limit, which can be exploited by an attacker to request large local assets via the /_next/image endpoint matching images.localPatterns (default allows all). This can cause out-of-memory conditions leading to denial of service. The vulnerability does not affect deployments on Vercel, custom image loaders, or when images.unoptimized is true. Red Hat advisory confirms the vulnerability and notes that no suitable mitigation or fix meeting their criteria is currently available. The CVSS 3.1 base score is 5.9 (medium severity) with network attack vector, high impact on availability, and no impact on confidentiality or integrity.

An attacker can remotely cause a denial of service by triggering out-of-memory conditions on the Next.js application server through the Image Optimization API. This disrupts availability of the application but does not affect confidentiality or integrity of data. The vulnerability affects self-hosted Next.js instances using the default image loader with default image pattern settings. It does not impact Vercel-hosted instances or those using custom image loaders or unoptimized images.

No official patch or fix is currently confirmed by the vendor or Red Hat. The vulnerability is not applicable when using Vercel hosting, a custom image loader, or setting images.unoptimized to true. Users are advised to consider these configurations to mitigate the risk. Since no suitable mitigation meeting Red Hat's criteria is available, upgrading to fixed versions 15.5.16 or later and 16.2.5 or later when possible is recommended. Monitor vendor advisories for updates on patches or mitigations.