CVE-2026-64644Medium▾ SunlitNext.js: Denial of Service in the Image Optimization API using SVGs
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.5%
0.5% → 0.7%
When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints.
config.images.remotePatterns, only the patterns in that array are impacted.config.images.unoptimized: true, you are NOT impacted.config.images.loader: 'custom', you are NOT impacted.If you cannot upgrade immediately, you can avoid the expensive work by setting config.experimental.imgOptSkipMetadata : true.
next >= 15.5.0, < 15.5.21next >= 16.0.0, < 16.2.11Upgrade to a patched release:
next 15.5.21next 16.2.11Connected by shared product, vendor, weakness, or advisory.
CVE-2026-64643MediumNext.js: Unauthenticated disclosure of internal Server Function endpoints
CVE-2026-64647MediumNext.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
GHSA-2464-fhr4-w9xwCriticalNext.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
CVE-2026-94482High· 8.2Next.js: Denial of Service in App Router using Server Actions
GHSA-673q-mjm6-r5xrCriticalNext.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
GHSA-vcvr-r3jv-pc5jCriticalNext.js: Remote Code Execution in next/og ImageResponse