AI BriefingSummary of CVE-2025-59471 and CVE-2025-59472 vulnerabilities
Key point
Two DoS vulnerabilities causing memory exhaustion have been discovered in self-hosted Next.js applications.
Details
Two medium-severity DoS (Denial-of-Service) vulnerabilities that can cause server downtime have been discovered in self-hosted Next.js applications. These vulnerabilities can cause memory exhaustion in certain configuration environments, but do not lead to data exposure or privilege escalation. However, applications hosted on the Vercel platform are not affected and require no separate action.
CVE-2025-59471 (CVSS 5.9) occurs when external image optimization is enabled via remotePatterns. The /_next/image endpoint can trigger an OOM (Out-of-Memory) condition by loading very large images hosted on allowed domains into memory without limits.
CVE-2025-59472 (CVSS 5.9) affects applications with PPR (Partial Pre-Rendering) enabled in minimal mode. When an unauthenticated user sends attacker-controlled data via a POST request, unbounded request buffering or decompression can exhaust memory.
Affected versions include the ranges Next.js 10 through 15.5.9 and 16 through 16.1.4, and the issue has been fixed in versions 15.5.10, 15.6.0-canary.61, 16.1.5, and 16.2.0-canary.9.
If an immediate update is not feasible, the following workarounds are recommended.
- Restrict or remove untrusted
remotePatterns - Disable PPR or minimal mode
- Apply strict request size limits at the reverse proxy layer
This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.
Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.