FRAMESCAN
← Blog

Next.js CVE-2026-44579 and CVE-2026-44577: Denial of Service fixed in 15.5.16

FrameScan · 2026-07-22

TL;DR

Two high-severity Denial of Service vulnerabilities affect Next.js: one in Cache Components (CVE-2026-44579, 15.0.0–15.5.15) and one in the Image Optimization API (CVE-2026-44577, 10.0.0–15.5.15). Both are resolved in next 15.5.16. If you use these features on public routes, a flood of requests could make your app unresponsive. Upgrade Next.js to 15.5.16 as soon as possible. Your next scheduled FrameScan scan already checks for both CVEs.

At-a-glance

ID Plain-English impact Severity Affected versions Fixed version
CVE-2026-44579 Connection floods can take your app down high >=15.0.0,<15.5.16 15.5.16
CVE-2026-44577 Image requests can exhaust resources and deny traffic high >=10.0.0,<15.5.16 15.5.16

CVE-2026-44579 — Cache Components connection exhaustion (Next.js)

An attacker can hammer endpoints that render Cache Components and cause your service to run out of available connections. Under sustained load, legitimate users may see timeouts or failures. Treat this as high urgency for internet-exposed pages using Cache Components.

Technical details

Summary based on the official advisory: applications using Cache Components may allow a pattern where many concurrent requests tie up connections, leading to Denial of Service. The fix in Next.js 15.5.16 addresses the underlying behavior in the framework. Until you can upgrade, you can reduce risk by rate limiting and quickly rejecting suspicious floods.

Illustrative example — not Next.js source code. This shows a defensive middleware pattern to shed load during spikes:

// middleware.js (illustrative mitigation until you upgrade)
// Applies simple in-memory rate limiting and quick rejection under surge.
import { NextResponse } from 'next/server';

const WINDOW_MS = 10_000; // 10 seconds
const MAX_HITS = 100; // per IP per window
const hits = new Map();

function cleanup(now) {
  for (const [ip, data] of hits) {
    if (now - data.start > WINDOW_MS) hits.delete(ip);
  }
}

export function middleware(req) {
  const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || 'local';
  const now = Date.now();
  cleanup(now);

  const data = hits.get(ip) || { start: now, count: 0 };
  data.count += 1;
  hits.set(ip, data);

  if (data.count > MAX_HITS) {
    return new NextResponse('Too Many Requests', { status: 429 });
  }

  return NextResponse.next();
}

export const config = {
  matcher: [
    // Focus on routes rendering Cache Components if known
    '/((?!_next|api/internal).*)',
  ],
};

CVE-2026-44577 — Image Optimization API DoS (Next.js)

Malicious image requests can tie up CPU, memory, or I/O and make your image-serving pages unresponsive. This can block legitimate traffic and degrade overall site performance. Prioritize upgrading if you rely on Next.js image optimization for public content.

Technical details

Per the official advisory, the Image Optimization API can be driven into a resource-exhaustion state by crafted requests. Next.js 15.5.16 includes the framework-level fix. As a short-term mitigation, enforce strict input bounds for image dimensions and quality if you proxy images or use a custom loader.

Illustrative example — not Next.js source code. This shows a custom API route that validates image parameters before work begins:

// app/api/optimize/route.js (illustrative mitigation until you upgrade)
import { NextResponse } from 'next/server';

const MAX_WIDTH = 1920;
const MAX_HEIGHT = 1920;
const MIN_QUALITY = 20;
const MAX_QUALITY = 85;

export async function GET(req) {
  const url = new URL(req.url);
  const src = url.searchParams.get('url');
  const w = Number(url.searchParams.get('w') || '0');
  const h = Number(url.searchParams.get('h') || '0');
  const q = Number(url.searchParams.get('q') || '75');

  if (!src) {
    return NextResponse.json({ error: 'Missing url' }, { status: 400 });
  }
  if (!Number.isFinite(w) || !Number.isFinite(h) || w <= 0 || h <= 0) {
    return NextResponse.json({ error: 'Invalid dimensions' }, { status: 400 });
  }
  if (w > MAX_WIDTH || h > MAX_HEIGHT) {
    return NextResponse.json({ error: 'Dimensions too large' }, { status: 413 });
  }
  if (!Number.isFinite(q) || q < MIN_QUALITY || q > MAX_QUALITY) {
    return NextResponse.json({ error: 'Invalid quality' }, { status: 400 });
  }

  // At this point you would fetch and transform the image safely with timeouts.
  // This example intentionally omits heavy processing to keep it safe and clear.
  return NextResponse.json({ ok: true, src, width: w, height: h, quality: q });
}

Remediation

Suggested commands:
- npm: npm install next@15.5.16
- Yarn: yarn add next@15.5.16
- pnpm: pnpm add next@15.5.16

Official advisories:
- CVE-2026-44579 — https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx
- CVE-2026-44577 — https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh

Call to action

Is your site exposed? Scan it for $1 →