GHSA-q8wf-6r8g-63ch

Suggest an improvement
Source
https://github.com/advisories/GHSA-q8wf-6r8g-63ch
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-q8wf-6r8g-63ch/GHSA-q8wf-6r8g-63ch.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-q8wf-6r8g-63ch
Aliases
Downstream
Published
2026-07-22T23:02:05Z
Modified
2026-09-10T03:50:52Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Next.js: Denial of Service in the Image Optimization API using SVGs
Details

Impact

When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints.

  • If you are using config.images.remotePatterns, only the patterns in that array are impacted.
  • If you are using config.images.unoptimized: true, you are NOT impacted.
  • If you are using config.images.loader: 'custom', you are NOT impacted.
  • If you are using Vercel, you are NOT impacted.

Workarounds

If you cannot upgrade immediately, you can avoid the expensive work by setting config.experimental.imgOptSkipMetadata : true.

Database specific 
{
    "cwe_ids": [
        "CWE-407"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-22T23:02:05Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}
References

Affected packages

npm / next

Package

Name
next
View open source insights on deps.dev
Purl
pkg:npm/next

Affected ranges

Type
SEMVER
Events
Introduced
15.5.0
Fixed
15.5.21

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-q8wf-6r8g-63ch/GHSA-q8wf-6r8g-63ch.json"

npm / next

Package

Name
next
View open source insights on deps.dev
Purl
pkg:npm/next

Affected ranges

Type
SEMVER
Events
Introduced
16.0.0
Fixed
16.2.11

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-q8wf-6r8g-63ch/GHSA-q8wf-6r8g-63ch.json"