AIKIDO-2026-10754
next is vulnerable to Denial of Service
59
Medium Risk
This Affects:
nextTL;DR
The Image Optimization API can load local image responses fully into memory without consistent maximum-size enforcement. Large local assets requested through optimization endpoints can exhaust process memory. This permits remote resource exhaustion in affected self-hosted configurations. The fix enforces response body limits for internal image fetches and aborts oversized streams.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
next is vulnerable to Denial of Service in versions 10.0.0 - 15.5.15 and 16.0.0 - 16.2.4.
How to fix this
Upgrade the next library to the patch version.
Links
GitHub Release
Other
access.redhat.com/errata/RHSA-2026:34608access.redhat.com/errata/RHSA-2026:37272access.redhat.com/errata/RHSA-2026:40974access.redhat.com/errata/RHSA-2026:54435access.redhat.com/security/cve/CVE-2026-44577bugzilla.redhat.com/show_bug.cgi?id=2477194security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44577.json
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.