CVE-2026-64644

Summary

Next.js: Denial of Service in the Image Optimization API using SVGs

Severity

medium

EPSS

0.7% (p52)

CWE

CWE-407

Also known as

GHSA-q8wf-6r8g-63ch

Published

2026-07-22

Updated

2026-07-22

Advisory details

Impact

When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints.

• If you are using config.images.remotePatterns, only the patterns in that array are impacted.
• If you are using config.images.unoptimized: true, you are NOT impacted.
• If you are using config.images.loader: 'custom', you are NOT impacted.
• If you are using Vercel, you are NOT impacted.

Workarounds

If you cannot upgrade immediately, you can avoid the expensive work by setting config.experimental.imgOptSkipMetadata : true.

References

• https://github.com/advisories/GHSA-q8wf-6r8g-63ch
• https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch
• https://github.com/vercel/next.js/pull/96006
• https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c
• https://github.com/vercel/next.js/releases/tag/v15.5.21
• https://github.com/vercel/next.js/releases/tag/v16.2.11

Related advisories

• GHSA-673q-mjm6-r5xr — critical · npm/next
• GHSA-2464-fhr4-w9xw — critical · npm/next
• GHSA-vcvr-r3jv-pc5j — critical · npm/next
• GHSA-2xp9-vwfh-vxw4 — critical · npm/next
• CVE-2026-75604 — critical · npm/next
• CVE-2026-94482 — high · npm/next
• CVE-2026-94483 — high · npm/next
• CVE-2026-64649 — high · npm/next

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity