5.9Medium

CVE-2026-44577Next.js: Denial of Service in the Image Optimization API

vercel next.js; Red Hat Streams for Apache Kafka 2.9.4; Red Hat Red Hat Trusted Artifact Signer 1.3; Red Hat Red Hat Trusted Artifact Signer 1.4 Published: 2026-05-13 20:00 (6 months ago)

Description

Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.

Weakness (CWE): CWE-770

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
amq streams	2.9	—
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	all versions
Red Hat	Red Hat Trusted Artifact Signer 1.3	all versions
Red Hat	Red Hat Trusted Artifact Signer 1.4	all versions
Red Hat	Streams for Apache Kafka 2.9.4	—
Red Hat	streams for Apache Kafka 3	all versions
trusted artifact signer	1.3	—
trusted artifact signer	1.4	—
vercel	next.js	>= 10.0.0, < 15.5.16, >= 16.0.0, < 16.2.5

References and patches

CPE matches (NVD) (2)

cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* ≥ 10.0.0 < 15.5.16
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* ≥ 16.0.0 < 16.2.5

CVSS score

5.9Medium

Source: GitHub_M · CVSS 3.1

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

All scores (4)

cna	CVSS 3.1	5.9Medium
redhat-SADP	CVSS 3.1	7.5High
security-advisories@github.com	CVSS 3.1	5.9Medium
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	CVSS 3.1	7.5High

EPSS (chance of exploitation in 30 days)

0.74%

higher than 55% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2026-05-06
Published2026-05-13 20:00
Reached IP-DB2026-10-24 23:39
Last updated2026-10-26 20:10

Assigned by (CNA): GitHub_M
NVD status: Modified

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Red Hat Enterprise Linux

6.5Medium

CVE-2026-121885 6 hours ago

Podman: untrusted image labels allow auto-update to restart arbitrary systemd units

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Hardened Images

A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart.…

7.5High

CVE-2026-124747 8 hours ago

Busybox: heap buffer overflow in wget ftp resume when the resume offset exceeds the reported file size

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Hardened Images

A flaw was found in BusyBox. When resuming a download over File Transfer Protocol (FTP), the wget utility fails to verify that the resume offset does not exceed the file size reported by the server, resulting in an integer calculation error. A malicious FTP s…

4.2Medium

CVE-2026-125709 9 hours ago

Libstdc++: overflow leaves streambuf in inconsistent state on i/o error.

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigg…

6.1Medium

CVE-2026-125707 9 hours ago

Gst-plugins-bad: gst-plugins-bad: off-by-one write in mxf demuxer temporal offset table

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can allow a one-byte write past the logical end of a temporal offset array. This may corrupt memory and cause the application to crash. T…

5.5Medium

CVE-2026-125706 9 hours ago

Gst-plugins-bad: gst-plugins-bad: missing bounds checks in mpeg ps pes header parsing

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG …

7.5High

CVE-2026-125712 9 hours ago

Gst-plugins-base: gst-plugins-base: missing bounds checks in rtcp sdes packet parsing

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiv…