Resource exhaustion in Vercel Next.js

CVE-2026-27980

Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allo…

Vulnerability class: DoS (Denial of Service)

EPSS: 0.000 (6.8th percentile) — read the EPSS interpretation.

Affected products

Vercel Next.js — versions >= 10.0.0, < 16.1.7

Weakness classification (CWE)

CWE-400 — Uncontrolled Resource Consumption

References

https://github.com/vercel/next.js/security/advisories/GHSA-3x4c-7xq6-9pq8 (x_refsource_CONFIRM)
https://github.com/vercel/next.js/commit/39eb8e0ac498b48855a0430fbf4c22276a73b4bd (x_refsource_MISC)
https://github.com/vercel/next.js/releases/tag/v16.1.7 (x_refsource_MISC)