Moderate severityOSV Advisory· Published Jan 26, 2026· Updated Jan 27, 2026

CVE-2025-59471

Description

A denial of service vulnerability exists in self-hosted Next.js applications that have remotePatterns configured for the Image Optimizer. The image optimization endpoint (/_next/image) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that remotePatterns is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.

Strongly consider upgrading to 15.5.10 or 16.1.5 to reduce risk and prevent availability issues in Next applications.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
nextnpm	>= 10.0.0, < 15.5.10	15.5.10
nextnpm	>= 15.6.0-canary.0, < 16.1.5	16.1.5

Affected products

Vercel/Next.jsOSV
Range: v10.0.0, v10.0.1, v10.0.1-canary.0, …

Patches

500ec8374363

fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)

https://github.com/vercel/next.jsStevenJan 15, 2026via ghsa

commit

8 files changed · +11 −11

docs/01-app/03-api-reference/02-components/image.mdx+4 −4 modified

@@ -839,22 +839,22 @@ module.exports = {
 
 #### `maximumResponseBody`
 
-The default image optimization loader will fetch source images up to 300 MB in size.
+The default image optimization loader will fetch source images up to 50 MB in size.
 
 ```js filename="next.config.js"
 module.exports = {
   images: {
-    maximumResponseBody: 300_000_000,
+    maximumResponseBody: 50_000_000,
   },
 }
 ```
 
-If you know all your source images are small, you can protect memory constrained servers by reducing this to a smaller value such as 50 MB.
+If you know all your source images are small, you can protect memory constrained servers by reducing this to a smaller value such as 5 MB.
 
 ```js filename="next.config.js"
 module.exports = {
   images: {
-    maximumResponseBody: 50_000_000,
+    maximumResponseBody: 5_000_000,
   },
 }
 ```

packages/next/src/shared/lib/image-config.ts+1 −1 modified

@@ -150,7 +150,7 @@ export const imageConfigDefault: ImageConfigComplete = {
   minimumCacheTTL: 14400, // 4 hours
   formats: ['image/webp'],
   maximumRedirects: 3,
-  maximumResponseBody: 300_000_000, // 300MB
+  maximumResponseBody: 50_000_000, // 50 MB
   dangerouslyAllowLocalIP: false,
   dangerouslyAllowSVG: false,
   contentSecurityPolicy: `script-src 'none'; frame-src 'none'; sandbox;`,

test/integration/next-image-new/app-dir-localpatterns/test/index.test.ts+1 −1 modified

@@ -98,7 +98,7 @@ function runTests(mode: 'dev' | 'server') {
             },
           ],
           maximumRedirects: 3,
-          maximumResponseBody: 300000000,
+          maximumResponseBody: 50000000,
           minimumCacheTTL: 14400,
           path: '/_next/image',
           qualities: [75],

test/integration/next-image-new/app-dir-qualities/test/index.test.ts+1 −1 modified

@@ -110,7 +110,7 @@ function runTests(mode: 'dev' | 'server') {
             },
           ],
           maximumRedirects: 3,
-          maximumResponseBody: 300000000,
+          maximumResponseBody: 50000000,
           minimumCacheTTL: 14400,
           path: '/_next/image',
           qualities: [42, 69, 88],

test/integration/next-image-new/app-dir/test/index.test.ts+1 −1 modified

@@ -1796,7 +1796,7 @@ function runTests(mode: 'dev' | 'server') {
             },
           ],
           maximumRedirects: 3,
-          maximumResponseBody: 300000000,
+          maximumResponseBody: 50000000,
           minimumCacheTTL: 14400,
           path: '/_next/image',
           qualities: [75],

test/integration/next-image-new/unicode/test/index.test.ts+1 −1 modified

@@ -103,7 +103,7 @@ function runTests(mode: 'server' | 'dev') {
             },
           ],
           maximumRedirects: 3,
-          maximumResponseBody: 300000000,
+          maximumResponseBody: 50000000,
           minimumCacheTTL: 14400,
           path: '/_next/image',
           qualities: [75],

test/integration/next-image-new/unoptimized/test/index.test.ts+1 −1 modified

@@ -118,7 +118,7 @@ function runTests(url: string, mode: 'dev' | 'server') {
             },
           ],
           maximumRedirects: 3,
-          maximumResponseBody: 300000000,
+          maximumResponseBody: 50000000,
           minimumCacheTTL: 14400,
           path: '/_next/image',
           qualities: [75],

test/unit/image-optimizer/fetch-external-image.test.ts+1 −1 modified

@@ -19,7 +19,7 @@ describe('fetchExternalImage', () => {
       const error = await fetchExternalImage(
         'http://example.com/no-body.jpg',
         false,
-        300_000_000
+        50_000_000
       ).catch((e) => e)
 
       expect(error).toBeInstanceOf(ImageError)

e5b834d208fe

fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)

https://github.com/vercel/next.jsStevenJan 15, 2026via ghsa

commit

8 files changed · +11 −11

docs/01-app/03-api-reference/02-components/image.mdx+4 −4 modified

@@ -776,22 +776,22 @@ module.exports = {
 
 #### `maximumResponseBody`
 
-The default image optimization loader will fetch source images up to 300 MB in size.
+The default image optimization loader will fetch source images up to 50 MB in size.
 
 ```js filename="next.config.js"
 module.exports = {
   images: {
-    maximumResponseBody: 300_000_000,
+    maximumResponseBody: 50_000_000,
   },
 }
 ```
 
-If you know all your source images are small, you can protect memory constrained servers by reducing this to a smaller value such as 50 MB.
+If you know all your source images are small, you can protect memory constrained servers by reducing this to a smaller value such as 5 MB.
 
 ```js filename="next.config.js"
 module.exports = {
   images: {
-    maximumResponseBody: 50_000_000,
+    maximumResponseBody: 5_000_000,
   },
 }
 ```

packages/next/src/shared/lib/image-config.ts+1 −1 modified

@@ -140,7 +140,7 @@ export const imageConfigDefault: ImageConfigComplete = {
   disableStaticImages: false,
   minimumCacheTTL: 60,
   formats: ['image/webp'],
-  maximumResponseBody: 300_000_000, // 300MB
+  maximumResponseBody: 50_000_000, // 50 MB
   dangerouslyAllowSVG: false,
   contentSecurityPolicy: `script-src 'none'; frame-src 'none'; sandbox;`,
   contentDispositionType: 'attachment',

test/integration/next-image-new/app-dir-localpatterns/test/index.test.ts+1 −1 modified

@@ -96,7 +96,7 @@ function runTests(mode: 'dev' | 'server') {
               search: '',
             },
           ],
-          maximumResponseBody: 300000000,
+          maximumResponseBody: 50000000,
           minimumCacheTTL: 60,
           path: '/_next/image',
           qualities: undefined,

test/integration/next-image-new/app-dir-qualities/test/index.test.ts+1 −1 modified

@@ -107,7 +107,7 @@ function runTests(mode: 'dev' | 'server') {
           loaderFile: '',
           remotePatterns: [],
           localPatterns: undefined,
-          maximumResponseBody: 300000000,
+          maximumResponseBody: 50000000,
           minimumCacheTTL: 60,
           path: '/_next/image',
           qualities: [42, 69, 88],

test/integration/next-image-new/app-dir/test/index.test.ts+1 −1 modified

@@ -1634,7 +1634,7 @@ function runTests(mode: 'dev' | 'server') {
           loaderFile: '',
           remotePatterns: [],
           localPatterns: undefined,
-          maximumResponseBody: 300000000,
+          maximumResponseBody: 50000000,
           minimumCacheTTL: 60,
           path: '/_next/image',
           qualities: undefined,

test/integration/next-image-new/unicode/test/index.test.ts+1 −1 modified

@@ -94,7 +94,7 @@ function runTests(mode: 'server' | 'dev') {
               search: '',
             },
           ],
-          maximumResponseBody: 300000000,
+          maximumResponseBody: 50000000,
           minimumCacheTTL: 60,
           path: '/_next/image',
           sizes: [

test/integration/next-image-new/unoptimized/test/index.test.ts+1 −1 modified

@@ -110,7 +110,7 @@ function runTests(url: string, mode: 'dev' | 'server') {
           loaderFile: '',
           remotePatterns: [],
           localPatterns: undefined,
-          maximumResponseBody: 300000000,
+          maximumResponseBody: 50000000,
           minimumCacheTTL: 60,
           path: '/_next/image',
           qualities: undefined,

test/unit/image-optimizer/fetch-external-image.test.ts+1 −1 modified

@@ -18,7 +18,7 @@ describe('fetchExternalImage', () => {
 
       const error = await fetchExternalImage(
         'http://example.com/no-body.jpg',
-        300_000_000
+        50_000_000
       ).catch((e) => e)
 
       expect(error).toBeInstanceOf(ImageError)

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000