VDB
KO
MEDIUM

GHSA-q8wf-6r8g-63ch

Next.js: Denial of Service in the Image Optimization API using SVGs

Quick fix

GHSA-q8wf-6r8g-63ch — next: upgrade to the fixed version with the command below. 

npm install next@15.5.21

Details

### Impact

When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in `/_next/image` endpoints.

- If you are using `config.images.remotePatterns`, only the patterns in that array are impacted. - If you are using `config.images.unoptimized: true`, you are NOT impacted. - If you are using `config.images.loader: 'custom'`, you are NOT impacted. - If you are using Vercel, you are NOT impacted.

### Workarounds

If you cannot upgrade immediately, you can avoid the expensive work by setting `config.experimental.imgOptSkipMetadata : true`.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm / next
Introduced in: 15.5.0 Fixed in: 15.5.21
Fix npm install next@15.5.21
npm / next
Introduced in: 16.0.0 Fixed in: 16.2.11
Fix npm install next@16.2.11

References