CVE-2025-59471

State: Published
Severity: 5.9 Medium
Published: Jan 26, 2026
Updated: Jan 27, 2026
Reserved: Sep 16, 2025

Description

A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.

Strongly consider upgrading to 15.5.10 or 16.1.5 to reduce risk and prevent availability issues in Next applications.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H	hackerone

Weaknesses

CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
nextvercel	10.0 to before 10.0Affected 11.0 to before 11.0Affected 12.0 to before 12.0Affected 13.0 to before 13.0Affected 14.0 to before 14.0Affected 15.0 to before 15.5.10Affected 16.0 to before 16.1.5Affected

References

https://github.com/vercel/next.js/security/advisories/GHSA-9g9p-9gw9-jx7f

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.