CVE-2025-59471: Next.js DoS Vulnerability via Image Optimizer RemotePatterns Configuration
Summary
CVE-2025-59471: Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration. Affects next across 2 version ranges.
>= 10.0.0, < 15.5.10
>= 15.6.0-canary.0, < 16.1.5
Fixed in 15.5.10 or 16.1.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Next.js is a popular React framework that enables developers to build server-rendered applications with ease. It provides features such as automatic code splitting, optimized performance, and a powerful image optimization tool. However, a vulnerability has been identified in self-hosted Next.js applications that utilize the Image Optimizer with specific configurations, making them susceptible to denial-of-service (DoS) attacks.
Vulnerability Detail
A denial-of-service (DoS) vulnerability exists in self-hosted Next.js applications that have 'remotePatterns' configured for the Image Optimizer. The image optimization endpoint ('/_next/image') loads external images entirely into memory without enforcing a maximum size limit. This allows an attacker to exploit the vulnerability by requesting the optimization of arbitrarily large images, potentially leading to out-of-memory conditions and service unavailability. The vulnerability requires that 'remotePatterns' is configured to allow image optimization from external domains, and the attacker must control or serve a large image from an allowed domain.
How To Fix
Latest published version: 16.4.2 as of 22 Oct 2026
npm install next@16.4.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 10.0.0, < 15.5.1015.5.10npm install next@15.5.10 -
>= 15.6.0-canary.0, < 16.1.516.1.5npm install next@16.1.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you may consider disabling the 'remotePatterns' configuration in your Next.js application until you can upgrade to a patched version. This can be done by removing or commenting out the relevant configuration in your next.config.js file:
// remotePatterns: [
// { protocol: 'https', hostname: 'example.com', pathname: '/**' },
// ],
Conclusion
In summary, the CVE-2025-59471 vulnerability in Next.js poses a significant risk to self-hosted applications utilizing the Image Optimizer with 'remotePatterns' configured. It is crucial to upgrade to the latest patched versions to mitigate this risk and ensure the availability of your application.
See every vulnerability recorded for next →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Failure to address this vulnerability may lead to denial-of-service conditions, causing your application to become unavailable to users.
Yes, you can temporarily disable the 'remotePatterns' configuration in your Next.js application as a workaround until you can upgrade.
The vulnerability affects Next.js versions starting from 10.0.0 up to 15.5.9 and from 15.6.0-canary.0 to 16.1.4.
References
Related vulnerabilities
Recent vulnerabilities recorded for next.
