Next.js Denial-of-Service Vulnerability in Image Optimizer

A denial-of-service vulnerability has been identified in self-hosted Next.js applications that use 'remotePatterns' for the Image Optimizer. The issue arises because the image optimization endpoint '/_next/image' processes external images entirely in memory without a maximum size limit. This allows an attacker to create out-of-memory conditions by requesting the optimization of excessively large images. The vulnerability requires 'remotePatterns' to be set for external domains and for the attacker to control a large image on an allowed domain.

Impact

Exploitation of this vulnerability can lead to out-of-memory conditions, causing availability issues in affected Next.js applications.

Remediation

Users are strongly advised to upgrade to Next.js versions 15.5.10 or 16.1.5 to mitigate this vulnerability.