Next.js: Denial of Service in the Image Optimization API using SVGs

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-64644 · Microsoft / collected KEV context

GHSA-q8wf-6r8g-63ch

cve-program · CVE-2026-64644

• https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch
• https://github.com/vercel/next.js/pull/96006
• https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c
• https://github.com/vercel/next.js/releases/tag/v15.5.21
• https://github.com/vercel/next.js/releases/tag/v16.2.11

nvd · CVE-2026-64644

• https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c
• https://github.com/vercel/next.js/pull/96006
• https://github.com/vercel/next.js/releases/tag/v15.5.21
• https://github.com/vercel/next.js/releases/tag/v16.2.11
• https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch

osv · GHSA-q8wf-6r8g-63ch

• https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch
• https://github.com/vercel/next.js/pull/96006
• https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c
• https://github.com/vercel/next.js
• https://github.com/vercel/next.js/releases/tag/v15.5.21
• https://github.com/vercel/next.js/releases/tag/v16.2.11

No related operational record is retained in the current change model.