| Package | Affected versions | Patched versions |
|---|---|---|
| next.js | ≥ 10.0.0, < 15.5.16≥ 16.0.0, < 16.2.5 | 15.5.1616.2.5 |
| next | ≥ 10.0.0, < 15.5.16≥ 16.0.0, < 16.2.5 | 15.5.1616.2.5 |
When self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed).
images.localPatterns, only the patterns in that array are impacted.images.unoptimized: true, you are NOT impacted.images.loader: 'custom', you are NOT impacted.We now apply response size limits consistently to internal image fetches, not just external ones, and fail oversized responses before they can exhaust process memory.
This can be adjusted using the images.maximumResponseBody configuration.
If you cannot upgrade immediately, avoid routing large local assets through /_next/image, disable image optimization for large or untrusted local files, or block image optimization access to those assets at the edge.
You can disable using the images.localPatterns: [] configuration. This will still allow fetching remote images (which is not impacted).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free