Next.js: Denial of Service in the Image Optimization API
Title source: cnaExploitation Summary
EIP tracks 2 public exploits for CVE-2026-44577. PoCs published by dwisiswant0, XZ1r0.
AI-analyzed exploit summary This repository contains functional proof-of-concept exploits for multiple CVEs in Next.js v16.2.4, including SSRF, XSS, and DoS vulnerabilities. The PoCs are well-documented with detailed write-ups, vulnerable code excerpts, and runnable exploit scripts.
Description
Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.
Exploits (2)
This repository contains functional proof-of-concept exploits for multiple CVEs in Next.js v16.2.4, including SSRF, XSS, and DoS vulnerabilities. The PoCs are well-documented with detailed write-ups, vulnerable code excerpts, and runnable exploit scripts.
This repository contains a functional exploit PoC for CVE-2026-44577, targeting a DoS vulnerability in Next.js versions < 16.2.5 via the `/_next/image` endpoint. The exploit demonstrates OOM (Out of Memory) by sending crafted requests with oversized image assets, leveraging a mock harness and real-world attack vectors.
References (1)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H