Uncontrolled resource consumption in vercel next
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 8 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain. Strongly consider upgrading to 15.5.10 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vercel | next | 10.0 to before 10.0; 11.0 to before 11.0; 12.0 to before 12.0; 13.0 to before 13.0; 14.0 to before 14.0; 15.0 to before 15.5.10; 16.0 to before 16.1.5 | 10.0, 11.0, 12.0, 13.0, 14.0, 15.5.10, 16.1.5 | Patch available | CNA |
| — | next (npm) | 10.0.0 to before 15.5.10 | 15.5.10 | Patch available | GHSA-9g9p-9gw9-jx7f |
| — | next (npm) | 15.6.0-canary.0 to before 16.1.5 | 16.1.5 | Patch available | GHSA-9g9p-9gw9-jx7f |
- next Vendorvercel Affected 10.0 to before 10.0; 11.0 to before 11.0; 12.0 to before 12.0; 13.0 to before 13.0; 14.0 to before 14.0; 15.0 to before 15.5.10; 16.0 to before 16.1.5 Fixed in 10.0, 11.0, 12.0, 13.0, 14.0, 15.5.10, 16.1.5 Patch available CNA
- next (npm) Vendor— Affected 10.0.0 to before 15.5.10 Fixed in 15.5.10 Patch available GHSA-9g9p-9gw9-jx7f
- next (npm) Vendor— Affected 15.6.0-canary.0 to before 16.1.5 Fixed in 16.1.5 Patch available GHSA-9g9p-9gw9-jx7f
Remediation
- Fix · CNA next (vercel) Fixed in 10.0, 11.0, 12.0, 13.0, 14.0, 15.5.10, 16.1.5
- Fix · GHSA-9g9p-9gw9-jx7f next (npm) Fixed in 15.5.10 Advisory →
- Fix · GHSA-9g9p-9gw9-jx7f next (npm) Fixed in 16.1.5 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 2 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 3 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-59471
- 2026-10-03 Alias added: GHSA-9g9p-9gw9-jx7f
References
Advisory 2
Other 5
- https://github.com/vercel/next.js/commit/500ec83743639addceaede95e95913398975156c
- https://github.com/vercel/next.js/commit/e5b834d208fe0edf64aa26b5d76dcf6a176500ec
- https://github.com/vercel/next.js
- https://github.com/vercel/next.js/releases/tag/v15.5.10
- https://github.com/vercel/next.js/releases/tag/v16.1.5
More vercel Next.js vulnerabilities
- TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
- TI-2025-21309 Authorization Bypass in Next.js Middleware CVSS 3.1CRITICAL 9.1
- TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
- TI-2024-31371 Cache Poisoning in next.js CVSS 3.1HIGH 7.5
- TI-2023-24914 Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch… CVSS 3.1HIGH 7.5
- TI-2026-32490 Next.js: Server-side request forgery in applications using WebSocket upgrades CVSS 3.1HIGH 8.6
Sources
- CVE-2025-59471 · CVE Program
- CVE-2025-59471 · NVD
- FIRST EPSS
- GHSA-9g9p-9gw9-jx7f · GitHub Advisory Database · CC BY 4.0
- CVE-2025-59471 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences