CVE-2026-27980

score

<0.1

cvss

7.5

epss

0.9%

published

2026-03-18

kev added

—

first seen

2026-10-21

Next.js >= 10.0.0 and < 16.1.7 contains a denial of service vulnerability caused by unbounded growth of the default image optimization disk cache, letting attackers exhaust disk space by generating many unique image variants, exploit requires ability to request many unique images.