Read the docs
TI-2026-22322 Aliases CVE-2026-27980GHSA-3x4c-7xq6-9pq8

Next.js: Unbounded next/image disk cache growth can exhaust storage

Priority LOW 38CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. This is fixed in version 16.1.7 by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. If upgrading is not immediately possible, periodically clean `.next/cache/images` and/or reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00725 54th percentileScored 2026-11-07
Fix Partial next.js (vercel): 16.1.7next (npm): 16.1.7, 15.5.14Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vercelnext.js10.0.0 to before 16.1.716.1.7Patch availableCNA
—next (npm)16.0.0-beta.0 to before 16.1.716.1.7Patch availableGHSA-3x4c-7xq6-9pq8
—next (npm)10.0.0 to before 15.5.1415.5.14Patch availableGHSA-3x4c-7xq6-9pq8
  • next.js Vendorvercel Affected 10.0.0 to before 16.1.7 Fixed in 16.1.7 Patch available CNA
  • next (npm) Vendor— Affected 16.0.0-beta.0 to before 16.1.7 Fixed in 16.1.7 Patch available GHSA-3x4c-7xq6-9pq8
  • next (npm) Vendor— Affected 10.0.0 to before 15.5.14 Fixed in 15.5.14 Patch available GHSA-3x4c-7xq6-9pq8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*10.0.0 to before 16.1.7Vulnerablevercel
  • cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* Versions 10.0.0 to before 16.1.7 Vulnerable ·vercel

Remediation

  • Fix · CNA next.js (vercel) Fixed in 16.1.7
  • Fix · GHSA-3x4c-7xq6-9pq8 next (npm) Fixed in 16.1.7 Advisory →
  • Fix · GHSA-3x4c-7xq6-9pq8 next (npm) Fixed in 15.5.14 Advisory →

Red Hat 2 advisories

  • RHSA-2026:34608 Released 2026-07-02 · Red Hat rating Important
    Streams for Apache Kafka 2.9.4 release and security update
    • Streams for Apache Kafka 2.9.4
  • RHSA-2026:13571 Released 2026-05-04 · Red Hat rating Critical
    Streams for Apache Kafka 3.2.0 release and security update
    • Streams for Apache Kafka 3.2.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Streams for Apache Kafka 2.9.4Fixed RHSA-2026:34608
Streams for Apache Kafka 3.2.0Fixed RHSA-2026:13571
Not affected: 2 products
  • Red Hat Enterprise Linux 9
  • Red Hat Trusted Artifact Signer

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27980
  2. 2026-10-03 Alias added: GHSA-3x4c-7xq6-9pq8
  3. 2026-10-08 Affected versions changed · Red Hat

References

Patch 1

Advisory 2

Other 2

  • TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-21309 Authorization Bypass in Next.js Middleware CVSS 3.1CRITICAL 9.1
  • TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
  • TI-2024-31371 Cache Poisoning in next.js CVSS 3.1HIGH 7.5
  • TI-2023-24914 Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch… CVSS 3.1HIGH 7.5
  • TI-2026-32490 Next.js: Server-side request forgery in applications using WebSocket upgrades CVSS 3.1HIGH 8.6
See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences