GHSA-9g9p-9gw9-jx7f
Medium · 5.9CVSS
5.9
EPSS
—
Published
Jan 27, 2026
CISA due date
—
The record
Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | next | 10.0.0 | 15.5.10 |
| npm | next | 15.6.0-canary.0 | 16.1.5 |
| Chainguard | langfuse-2 | 0 | 2.95.12-r9 |
| Chainguard | langfuse-3 | 0 | 3.153.0-r0 |
| Chainguard | langfuse-fips-2 | 0 | 2.95.12-r10 |
| Chainguard | langfuse-fips-3 | 0 | 3.152.0-r0 |
| Wolfi | langfuse-3 | 0 | 3.153.0-r0 |
Related vulnerabilities
- CVE-2025-59471 A denial of service vulnerability exists in self-hosted Next.js applications that have… Same vulnerability
- CVE-2026-44582 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-45109 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44581 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44580 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44579 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44578 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44576 Next.js is a React framework for building full-stack web applications. Also affects next