Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (/_next/image) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. This is fixed in version 16.1.7 by adding an LRU-backed disk cache with images.maximumDiskCacheSize, including eviction of least-recently-used entries when the limit is exceeded. Setting maximumDiskCacheSize: 0 disables disk caching. If upgrading is not immediately possible, periodically clean .next/cache/images and/or reduce variant cardinality (e.g., tighten values for images.localPatterns, images.remotePatterns, and images.qualities).
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-400"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27980.json"
}{
"extracted_events": [
{
"cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "10.0.0"
},
{
"fixed": "16.1.7"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "39eb8e0ac498b48855a0430fbf4c22276a73b4bd"
}
],
"source": "REFERENCES_COMMIT"
},
{
"original_tag": "v16.1.7",
"range": [
{
"fixed": "bdf3e3577a6d55ea186a48238d61fbd8da07a626"
}
],
"source": "REFERENCES_TAG"
}
]
}