cbcvebase.
CVE-2026-44577
published 2026-05-13

CVE-2026-44577: Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default…

PriorityP433medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
0.66%
46.8th percentile
Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.

Affected

14 ranges
VendorProductVersion rangeFixed in
mozillafirefox
mozillathunderbird
nextnext
nextnext>= 10.0.0 < 15.5.1615.5.16
nextnext>= 16.0.0 < 16.2.516.2.5
rhelai3bootc-cuda-rhel9
rhelai3bootc-gaudi-rhel9
rhelai3bootc-rocm-rhel9
rhelai3disk-image-cuda-rhel9
rhtasrekor-search-ui-rhel9
vercelnext.js
vercelnext.js
vercelnext.js>= 10.0.0 < 15.5.1615.5.16
vercelnext.js>= 16.0.0 < 16.2.516.2.5

CVSS provenance

nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.