CVE-2025-59471

Executive Summary

CVE-2025-59471 is a denial of service (DoS) vulnerability affecting self-hosted Next.js applications that utilize the Image Optimizer with remotePatterns configured. The vulnerability resides in the /_next/image endpoint, which loads external images entirely into memory without enforcing a maximum size limit. An attacker can exploit this by requesting optimization of arbitrarily large images from an allowed external domain, causing out-of-memory (OOM) conditions and crashing the Node.js process. The vulnerability requires that remotePatterns is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain. The CVSS score is 5.9 (Medium), with a high availability impact. No public proof-of-concept (PoC) or exploit code is currently available. The recommended mitigation is to upgrade to Next.js 15.5.10 or 16.1.5.

Supply Chain & Package Security

This vulnerability affects the Next.js npm package. Organizations using self-hosted Next.js applications with remotePatterns configured are at risk. The supply chain risk is moderate, as the vulnerability is in the core image optimization feature. Ensure that the npm package is updated to a patched version and that remotePatterns is reviewed and restricted to trusted domains only.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 5.9 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but it requires the attacker to control or serve a large image on an allowed domain. The impact is limited to denial of service, with no data breach or integrity compromise.

Deep Dive & Mechanics

The Next.js Image Optimizer endpoint (/_next/image) is designed to fetch external images, optimize them (e.g., resize, format conversion), and serve them to clients. When remotePatterns is configured, the optimizer will fetch images from allowed external domains. The vulnerability occurs because the optimizer reads the entire image into memory before processing, without checking the image's size. An attacker can craft a request to /_next/image with a URL pointing to an extremely large image (e.g., a multi-gigabyte file) hosted on an allowed domain. The Node.js process will attempt to load this entire image into memory, leading to memory exhaustion and a crash.

Key Mechanics:

1. The attacker identifies a Next.js application with remotePatterns configured.
2. The attacker hosts or controls a large image (e.g., 10GB) on an allowed domain.
3. The attacker sends a request to /_next/image?url=https://allowed-domain.com/large-image.jpg&w=100&q=75.
4. The Next.js server fetches the image and loads it entirely into memory.
5. The server runs out of memory, causing a denial of service.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In the image optimization handler
async function optimizeImage(url, width, quality) {
  const response = await fetch(url);
  const buffer = await response.buffer(); // No size check
  // Process buffer...
}

Patched Code (Conceptual):

// In the image optimization handler
const MAX_IMAGE_SIZE = 10 * 1024 * 1024; // 10MB limit
async function optimizeImage(url, width, quality) {
  const response = await fetch(url);
  const contentLength = response.headers.get('content-length');
  if (contentLength && parseInt(contentLength) > MAX_IMAGE_SIZE) {
    throw new Error('Image too large');
  }
  const buffer = await response.buffer();
  if (buffer.length > MAX_IMAGE_SIZE) {
    throw new Error('Image too large');
  }
  // Process buffer...
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A self-hosted Next.js application with remotePatterns configured.
• An external domain allowed by remotePatterns where you can host a large image.

Steps:

1. Host a large image: Create a very large image file (e.g., 10GB) and host it on an allowed domain.

   # Generate a large dummy image using ImageMagick
   convert -size 100000x100000 xc:white large.jpg
   

2. Craft the exploit request:

   curl "http://target-nextjs-app.com/_next/image?url=https://attacker-controlled-domain.com/large.jpg&w=100&q=75"
   

3. Repeat requests to accelerate memory exhaustion.

Expected Outcome: The Next.js server crashes due to out-of-memory, causing a denial of service.

Blue Team (Defender)

Detection:

• Monitor for unusually large image requests to /_next/image.
• Set up alerts for high memory usage on the Node.js process.
• Use the detection rules provided below.

Mitigation:

• Immediately upgrade to Next.js 15.5.10 or 16.1.5.
• If upgrade is not possible, restrict remotePatterns to only trusted domains and implement a reverse proxy (e.g., Nginx) to limit request body size.
• Example Nginx rule:

  location /_next/image {
    client_max_body_size 10m;
    proxy_pass http://nextjs-app;
  }
  

Indicators of Compromise (IOCs)

• Network: HTTP requests to /_next/image with extremely large image URLs (e.g., >100MB).
• System: High memory usage by the Node.js process, followed by process crash.
• Logs: Error logs indicating out-of-memory errors in the Next.js application.
• File: Temporary files in the Next.js cache directory that are abnormally large.

Detection Engineering

YARA Rule

rule NextJS_ImageOptimizer_DoS_CVE202559471 {
    meta:
        description = "Detects attempts to exploit CVE-2025-59471 by requesting large images"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-59471"
    strings:
        $s1 = "/_next/image" ascii wide nocase
        $s2 = "url=" ascii wide nocase
        $s3 = ".jpg" ascii wide nocase
        $s4 = ".png" ascii wide nocase
        $s5 = ".gif" ascii wide nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: Next.js Image Optimizer DoS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to /_next/image with large image URLs
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nextjs
detection:
    selection:
        cs-uri-query|contains: "/_next/image"
        cs-uri-query|contains: "url="
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate image optimization requests
level: medium

Suricata Rule

alert http any any -> any any (msg:"Next.js Image Optimizer DoS Attempt"; flow:to_server; content:"/_next/image"; http_uri; content:"url="; http_uri; pcre:"/\.(jpg|png|gif|webp)/iU"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Next.js: Upgrade to version 15.5.10 or 16.1.5.

   npm install next@15.5.10
   # or
   npm install next@16.1.5
   

2. Restrict remotePatterns: If upgrade is not possible, restrict remotePatterns to only trusted domains and limit the number of allowed domains.
3. Implement a reverse proxy: Use Nginx or Apache to limit request body size and rate-limit requests to /_next/image.

Long-term Measures:

• Regularly update Next.js and other dependencies.
• Monitor for new CVEs and apply patches promptly.
• Implement Web Application Firewall (WAF) rules to block suspicious image optimization requests.

Valters IT
Securing Digital Frontiers