Is there a patch available for CVE-2026-64644?

Yes, a patch is available for CVE-2026-64644. Update the affected software to the latest version immediately.

Next.js CVE-2026-64644

Q: What is the CVSS score of CVE-2026-64644?

CVE-2026-64644 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-49388 MEDIUM

Inefficient Algorithmic Complexity (CWE-407)

2026-07-22 https://github.com/vercel/next.js

GHSA-q8wf-6r8g-63ch

Information Disclosure Red Hat

6.3

CVSS 4.0 · Vendor: https://github.com/vercel/next.js

Severity by source

Vendor (https://github.com/vercel/next.js) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

AV:N for public endpoint, AC:H because non-default remotePatterns config and pattern-matching constraint are required; no auth or user interaction needed; availability-only impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (https://github.com/vercel/next.js).

CVSS VectorVendor: https://github.com/vercel/next.js

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 27, 2026 - 18:22 NVD

6.3 (MEDIUM)

Source Code Evidence Fetched

Jul 22, 2026 - 23:31 vuln.today

Analysis Generated

Jul 22, 2026 - 23:31 vuln.today

CVE Published

Jul 22, 2026 - 23:02 cve.org

MEDIUM

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

19 npm packages depend on next (19 direct, 0 indirect)

Ecosystem-wide dependent count for version 15.5.0.

DescriptionCVE.org

Impact

When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints.

If you are using config.images.remotePatterns, only the patterns in that array are impacted.
If you are using config.images.unoptimized: true, you are NOT impacted.
If you are using config.images.loader: 'custom', you are NOT impacted.
If you are using Vercel, you are NOT impacted.

Workarounds

If you cannot upgrade immediately, you can avoid the expensive work by setting config.experimental.imgOptSkipMetadata : true.

AnalysisAI

CPU exhaustion in the Next.js Image Optimization API allows unauthenticated remote attackers to deny service against the /_next/image endpoint by serving malicious image content - particularly crafted SVGs - from domains permitted by config.images.remotePatterns. Affected self-hosted deployments on Next.js 15.5.0-15.5.20 and 16.0.0-16.2.10 using the default image loader invoke Sharp's expensive .metadata() call on attacker-influenced buffers, exhausting server CPU. Vendor-released patches are available in versions 15.5.21 and 16.2.11; no public exploit or CISA KEV listing is identified at time of analysis.

Technical ContextAI

The vulnerability (CWE-407: Inefficient Algorithmic Complexity) resides in Next.js's server-side image-optimizer.ts module, specifically the detectContentType function. In affected versions, when magic-byte detection failed to identify an image format, the code fell back to invoking Sharp's asynchronous .metadata() method on the full upstream image buffer - a deep, CPU-intensive parse operation. Crafted SVGs or other images engineered to evade magic-byte detection but trigger the Sharp metadata path could cause sustained CPU consumption. The patch (PR #96006, commit 93cb90891402fa4c47798d03cb9e05c13233766c) eliminates the Sharp fallback entirely, restricting format detection to a fast magic-byte scan of only the first 1,024 bytes (buffer.subarray(0, 1024)). It also permanently removes the imgOptSkipMetadata experimental configuration flag that served as the prior workaround, and prunes support for exotic Sharp-only formats (TIFF, PDF, AVIF-via-metadata, etc.) from the detection switch. Affected packages: pkg:npm/next versions >=15.5.0,<15.5.21 and >=16.0.0,<16.2.11.

RemediationAI

Upgrade to Next.js 15.5.21 (for 15.x deployments) or 16.2.11 (for 16.x deployments); these releases remove the vulnerable Sharp metadata fallback and are confirmed by release tags at https://github.com/vercel/next.js/releases/tag/v15.5.21 and https://github.com/vercel/next.js/releases/tag/v16.2.11. The patch is available via PR #96006 and commit 93cb90891402fa4c47798d03cb9e05c13233766c. If immediate upgrade is not feasible, set config.experimental.imgOptSkipMetadata: true in next.config.js - this skips the Sharp metadata path and eliminates the expensive processing, though it is an experimental flag and should be removed after patching. As a more disruptive alternative, setting config.images.unoptimized: true or switching to a custom loader bypasses the vulnerable code path entirely but disables image optimization globally, which may affect performance and image delivery quality. Operators should also audit their remotePatterns configuration to minimise the set of allowed remote domains, reducing attacker-controlled surface even on unpatched versions.