Inefficient Algorithmic Complexity Affecting next package, versions >=15.5.0 <15.5.21>=16.0.0 <16.2.11

next is a react framework.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the detectContentType path in next/dist/server/image-optimizer. An attacker can exhaust CPU in /_next/image by sending a remotely hosted SVG that forces expensive content-type detection during image optimization. The vulnerable code runs when the default image loader optimizes configured remote images, so a malicious SVG in config.images.remotePatterns can make the Image Optimization API spend excessive time parsing the response before serving it. This degrades or stalls image requests for users of self-hosted Next.js deployments that rely on the default optimizer.

Notes

• Self-hosted deployments only: the expensive path is in the default Image Optimization API, so config.images.loader: 'custom', config.images.unoptimized: true, and Vercel-hosted apps are outside the vulnerable deployment pattern.
• The affected remote-image surface is limited to the patterns listed in config.images.remotePatterns; only those configured origins can drive the costly SVG content-type detection work.

Workarounds

• Set config.experimental.imgOptSkipMetadata: true to avoid the expensive metadata-detection path in /_next/image, which mitigates the CPU-exhaustion attack from malicious remote SVGs.

• GitHub Commit
• GitHub PR
• Maintainer's Advisory