CVE-2025-59471 Details
Description
A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain. Strongly consider upgrading to 15.5.10 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
A denial-of-service vulnerability has been identified in self-hosted Next.js applications that use 'remotePatterns' for the Image Optimizer. The issue arises because the image optimization endpoint '/_next/image' processes external images entirely in memory without a maximum size limit. This allows an attacker to create out-of-memory conditions by requesting the optimization of excessively large images. The vulnerability requires 'remotePatterns' to be set for external domains and for the attacker to control a large image on an allowed domain.
Users are strongly advised to upgrade to Next.js versions 15.5.10 or 16.1.5 to mitigate this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vercel/next.js/security/advisories/GHSA-9g9p-9gw9-jx7f | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| vercel next.js | >= 10.0.0, < 15.5.10 >= 16.0.0, < 16.1.5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 13, 2026 | Initial Analysis | [email protected] |
| Jan 27, 2026 | CVE Modified | CISA-ADP |
| Jan 26, 2026 | New CVE Received | [email protected] |