| Package | Affected versions | Patched versions |
|---|---|---|
| next.js | ≥ 15.5.0, < 15.5.21≥ 16.0.0, < 16.2.11 | 15.5.2116.2.11 |
| next | ≥ 15.5.0, < 15.5.21≥ 16.0.0, < 16.2.11 | 15.5.2116.2.11 |
When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints.
config.images.remotePatterns, only the patterns in that array are impacted.config.images.unoptimized: true, you are NOT impacted.config.images.loader: 'custom', you are NOT impacted.If you cannot upgrade immediately, you can avoid the expensive work by setting config.experimental.imgOptSkipMetadata : true.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free