CVE-2026-64644: Vercel Next.js DOS Vulnerability

CVE-2026-64644 Overview

CVE-2026-64644 is a denial-of-service vulnerability in the Next.js Image Optimization API. The flaw affects self-hosted Next.js deployments running versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10. When the default image loader is configured with config.images.remotePatterns, remotely hosted images containing malicious content can trigger CPU exhaustion in the /_next/image endpoint. The root cause is tracked as CWE-407: Inefficient Algorithmic Complexity. Deployments using config.images.unoptimized: true, config.images.loader: 'custom', or Vercel-hosted applications are not affected. Fixes shipped in 15.5.21 and 16.2.11.

Critical Impact
Unauthenticated remote attackers can serve crafted images that cause sustained CPU exhaustion on Next.js image optimization workers, degrading availability for legitimate users.

Affected Products

Vercel Next.js 15.5.0 through 15.5.20 (self-hosted, default image loader)
Vercel Next.js 16.0.0 through 16.2.10 (self-hosted, default image loader)
Applications configuring config.images.remotePatterns with the default loader

Discovery Timeline

2026-07-27 - CVE-2026-64644 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-64644

Vulnerability Analysis

The vulnerability resides in the Next.js image optimization pipeline exposed via /_next/image. When self-hosted with the default loader, Next.js fetches remote images matching entries in config.images.remotePatterns and processes them server-side. The detectContentType() routine and adjacent image inspection logic perform work whose runtime scales poorly against adversarial inputs. An attacker who can request optimization of a malicious remote image forces the worker to spend excessive CPU cycles per request. Repeated requests exhaust available CPU, delaying or blocking legitimate image responses and, in constrained environments, adjacent HTTP traffic.

Root Cause

The underlying weakness is inefficient algorithmic complexity ([CWE-407]) in content-type detection and metadata handling for remote images. Prior releases exposed a configuration flag, imgOptSkipMetadata, and processed metadata paths that malicious inputs could weaponize. The upstream patch removes imgOptSkipMetadata from the configuration schema and improves the performance of detectContentType() so that worst-case input no longer produces disproportionate CPU cost.

Attack Vector

Exploitation requires network access to a vulnerable /_next/image endpoint on a self-hosted Next.js deployment configured with remotePatterns. No authentication or user interaction is required. The attacker hosts a crafted image on an origin matching an allowed remote pattern, then issues repeated requests through the optimization endpoint to trigger sustained CPU exhaustion.

typescript

// Patch excerpt from packages/next/src/server/config-schema.ts
   imgOptTimeoutInSeconds: z.number().int().optional(),
   imgOptMaxInputPixels: z.number().int().optional(),
   imgOptSequentialRead: z.boolean().optional().nullable(),
-  imgOptSkipMetadata: z.boolean().optional().nullable(),
   isrFlushToDisk: z.boolean().optional(),
   largePageDataBytes: z.number().optional(),
   linkNoTouchStart: z.boolean().optional(),

// Patch excerpt from packages/next/src/server/config-shared.ts
   imgOptTimeoutInSeconds?: number
   imgOptMaxInputPixels?: number
   imgOptSequentialRead?: boolean | null
-  imgOptSkipMetadata?: boolean | null
   optimisticClientCache?: boolean

Source: vercel/next.js commit 93cb908. The fix removes the imgOptSkipMetadata option and improves detectContentType() performance to mitigate adversarial inputs.

Detection Methods for CVE-2026-64644

Indicators of Compromise

Sustained high CPU utilization on Next.js server processes correlated with traffic to /_next/image.
Repeated /_next/image requests with url= parameters pointing to the same or few remote origins matching remotePatterns.
Elevated response latency or timeouts on image optimization endpoints while other routes remain responsive.

Detection Strategies

Alert on request-rate spikes to /_next/image from single source IPs or narrow ranges.
Correlate process-level CPU saturation with concurrent inbound requests targeting the image optimization path.
Inspect access logs for outbound fetches to remote image hosts that do not match expected content distribution patterns.

Monitoring Recommendations

Track CPU, event-loop lag, and request latency for Next.js workers as first-class SLOs.
Log the url query parameter of /_next/image requests and aggregate by remote origin.
Enable rate limiting and per-IP request budgets at the reverse proxy or CDN in front of Next.js.

How to Mitigate CVE-2026-64644

Immediate Actions Required

Upgrade self-hosted Next.js to 15.5.21 or 16.2.11 on all affected deployments.
Inventory application configurations for use of config.images.remotePatterns with the default loader.
Apply rate limiting to /_next/image at the CDN, WAF, or reverse proxy layer until patching is complete.

Patch Information

The fix ships in Next.js 15.5.21 and 16.2.11. See the GitHub Security Advisory GHSA-q8wf-6r8g-63ch, the remediation pull request #96006, and the release notes for v15.5.21 and v16.2.11.

Workarounds

Set config.images.unoptimized: true to disable server-side optimization if remote optimization is not required.
Switch to config.images.loader: 'custom' and delegate image handling to an external service.
Remove or tighten entries in config.images.remotePatterns so only trusted origins are optimized.
Deploy on Vercel, which is not affected by this issue.

bash

# next.config.js — restrict or disable remote image optimization
module.exports = {
  images: {
    // Option 1: disable server-side optimization
    unoptimized: true,

    // Option 2: tightly scope remotePatterns to trusted origins
    remotePatterns: [
      {
        protocol: 'https',
        hostname: 'assets.example.com',
        pathname: '/images/**',
      },
    ],
  },
}