AIKIDO-2026-10754
next is vulnerable to Denial of Service
59
Medium Risk
This Affects:
nextTL;DR
The Image Optimization API can load local image responses fully into memory without consistent maximum-size enforcement. Large local assets requested through optimization endpoints can exhaust process memory. This permits remote resource exhaustion in affected self-hosted configurations. The fix enforces response body limits for internal image fetches and aborts oversized streams.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
next is vulnerable to Denial of Service in versions 10.0.0 - 15.5.15 and 16.0.0 - 16.2.4.
How to fix this
Upgrade the next library to the patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant