CVE-2026-64644

A flaw was found in Next.js, a React framework. When self-hosting Next.js with the default image loader and configured to optimize remotely hosted images, a remote attacker could exploit the Image Optimization API. By providing malicious images, the attacker can cause CPU exhaustion, leading to a Denial of Service (DoS) in the /_next/image endpoints. This vulnerability specifically affects configurations using config.images.remotePatterns.

This is an Important denial of service vulnerability in Next.js applications. When self-hosting Next.js with the default image loader, the Image Optimization API can be exploited if the config.images.remotePatterns option is explicitly configured to optimize remotely hosted, malicious images. This configuration is not enabled by default in Red Hat supported products, limiting exposure to environments where this specific feature has been activated.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.