All vulnerabilities

npm

CVE-2026-64644

Next.js: Denial of Service in the Image Optimization API using SVGs

Severity: Medium
Published: 22 Jul 2026
Last changed: 10 Sept 2026
Added to UpHeron: 14 Oct 2026
Fixed in: 15.5.21, 16.2.11
Also known as: GHSA-q8wf-6r8g-63ch
Sources: OSV.dev and GitHub

Affected software

Software	Affected versions
Next.jsnpm · `osv:npm:next`	From 15.5.0 before 15.5.21 From 16.0.0 before 16.2.11

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-64644
GitHub Advisory Database https://github.com/advisories/GHSA-q8wf-6r8g-63ch