Summary
Next.js: Denial of Service in the Image Optimization API using SVGs
Advisory details
Impact
When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints.
- If you are using
config.images.remotePatterns, only the patterns in that array are impacted. - If you are using
config.images.unoptimized: true, you are NOT impacted. - If you are using
config.images.loader: 'custom', you are NOT impacted. - If you are using Vercel, you are NOT impacted.
Workarounds
If you cannot upgrade immediately, you can avoid the expensive work by setting config.experimental.imgOptSkipMetadata : true.
References
- https://github.com/advisories/GHSA-q8wf-6r8g-63ch
- https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch
- https://github.com/vercel/next.js/pull/96006
- https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c
- https://github.com/vercel/next.js/releases/tag/v15.5.21
- https://github.com/vercel/next.js/releases/tag/v16.2.11
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-71429
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
- MEDIUMCVE-2026-82398
pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace
- MEDIUMCVE-2026-81722
NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'
- MEDIUMCVE-2026-81723
NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`
- MEDIUMCVE-2026-12876
NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars
- MEDIUMCVE-2026-84305
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption