CVE-2025-59471

Overview

Next.js is a React framework that provides server-side rendering, routing, and production tooling for web applications. The next/server component includes an image optimization pipeline used by next/image to fetch and optimize remote images at runtime.

‍

A medium-severity Denial of Service (DoS) vulnerability, CVE-2025-59471, exists in Next.js v12 when the image optimizer fetches remote images without enforcing a maximum response size. Attackers could supply or host oversized images that cause excessive memory usage and service instability causing the application to crash or become unresponsive due to memory exhaustion, resulting in a Denial of Service for intended users.

‍

Per OWASP: A Denial of Service (DoS) attack is an attack where attackers attempt to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet.

‍

Details

Module Info

• Product: Next.js
• Affected packages: next
• Affected versions: 
  
  • >=10.0.0 <15.5.10,
  • >=15.6.0-canary.0 <16.1.5
• GitHub repository: https://github.com/vercel/next.js
• Published packages: https://www.npmjs.com/package/next
• Package manager: npm
• Fixed in:
  
  • OSS versions: v15.5.10, v16.1.5
  • NES for Next.js v12.3.12

‍

Vulnerability Info

This vulnerability affects the next/image remote fetch path in v12. The optimizer downloaded remote images without a built-in maximum size, so a large upstream response could be fully buffered in memory.

‍

The risk is twofold:

‍

• missing maximum size enforcement allowed arbitrarily large payloads
• absence of an early header check meant large responses were buffered before rejection

‍

An attacker could exploit this by hosting an oversized image or proxying large responses, triggering high memory usage and degrading availability. 

‍

Mitigation

Next.js version 12 is End-of-Life and will not receive any updates to address this issue. For more information see the Next.js Support Policy.

‍

Users of the affected components should apply one of the following mitigations:

‍

• Upgrade affected applications to a fixed version of Next.js.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍