CVE-2026-27980 Details
Description
Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. This is fixed in version 16.1.7 by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. If upgrading is not immediately possible, periodically clean `.next/cache/images` and/or reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`).
A denial-of-service vulnerability exists in Next.js versions 10.0.0 through 16.1.6, related to unbounded disk cache growth in the default image optimization feature. The lack of a configurable upper limit allowed excessive cache accumulation, which could be exploited to exhaust available disk space. This issue has been addressed in Next.js version 16.1.7 by introducing an LRU-backed disk cache with a configurable maximum size, along with automatic eviction of least-recently-used entries when the limit is surpassed. Users can also disable disk caching by setting the maximumDiskCacheSize value to zero. If an immediate upgrade isn't feasible, it's recommended to manually clear the image cache directory or adjust image optimization settings to reduce cache usage.
Upgrade to Next.js version 16.1.7 or later. If an immediate upgrade isn't possible, periodically clean the '.next/cache/images' directory and reduce the number of image optimization variants.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vercel next.js | >= 10.0.0, < 16.1.7 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 18, 2026 | Initial Analysis | [email protected] |
| Mar 18, 2026 | New CVE Received | [email protected] |