CVE-2026-27980

An unbounded disk usage flaw has been discovered in Next.js. The default Next.js image optimization disk cache (/_next/image) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service.

This vulnerability is rated as Moderate because, while an unauthenticated remote user can trigger unbounded cache allocation to exhaust filesystem storage and degrade service availability, it does not allow code execution or compromise data integrity and confidentiality. Within Red Hat environments utilizing Next.js web applications, the flaw is restricted to deployments actively serving image optimization endpoints directly from persistent local storage. Deployments that offload image handling or operate behind caching proxies with strict request and file quotas will experience limited disruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.