CVE-2026-44577

Workarounds

If you cannot upgrade immediately, avoid routing large local assets through /_next/image, disable image optimization for large or untrusted local files, or block image optimization access to those assets at the edge.

You can disable using the images.localPatterns: [] configuration. This will still allow fetching remote images (which is not impacted).

When self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed).

• If you are using images.localPatterns, only the patterns in that array are impacted.
• If you are using images.unoptimized: true, you are NOT impacted.
• If you are using images.loader: 'custom', you are NOT impacted.
• If you are using Vercel, you are NOT impacted.

The application allocates resources such as memory, threads, or file descriptors based on untrusted input without enforcing a cap. Typical impact: resource exhaustion leading to denial of service.

CVE-2026-44577 has a CVSS score of 5.9 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (15.5.16, 16.2.5); upgrading removes the vulnerable code path.

Kodem intelligence

We now apply response size limits consistently to internal image fetches, not just external ones, and fail oversized responses before they can exhaust process memory.

This can be adjusted using the images.maximumResponseBody configuration.

1. What is CVE-2026-44577? CVE-2026-44577 is a medium-severity allocation of resources without limits or throttling vulnerability in next (npm), affecting versions >= 10.0.0, < 15.5.16. It is fixed in 15.5.16, 16.2.5. The application allocates resources such as memory, threads, or file descriptors based on untrusted input without enforcing a cap.
2. How severe is CVE-2026-44577? CVE-2026-44577 has a CVSS score of 5.9 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of next are affected by CVE-2026-44577? next (npm) versions >= 10.0.0, < 15.5.16 is affected.
4. Is there a fix for CVE-2026-44577? Yes. CVE-2026-44577 is fixed in 15.5.16, 16.2.5. Upgrade to this version or later.
5. Is CVE-2026-44577 exploitable, and should I be worried? Whether CVE-2026-44577 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-44577 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-44577?
   • Upgrade next to 15.5.16 or later
   • Upgrade next to 16.2.5 or later