CVE-2025-59471

score

<0.1

cvss

5.9

epss

0.5%

published

2026-01-26

kev added

—

first seen

2026-10-21

Next.js contains a denial of service caused by unbounded memory usage in the Image Optimizer endpoint when remotePatterns allow external images, letting attackers cause out-of-memory conditions by requesting large images, exploit requires remotePatterns configured for external domains and attacker-controlled large image.