A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain. Strongly consider upgrading to 15.5.10 or 16.1.5 to reduce risk and prevent availability issues in Next applications.

The Next.js Framework on the remote host is affected by a denial of service vulnerability:

  - A denial of service vulnerability exists in self-hosted Next.js applications that have remotePatterns     configured for the Image Optimizer. The image optimization endpoint (/_next/image) loads external images     entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory     conditions by requesting optimization of arbitrarily large images. This vulnerability requires that     remotePatterns is configured to allow image optimization from external domains and that the attacker can     serve or control a large image on an allowed domain. (CVE-2025-59471)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns`
    configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images
    entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory
    conditions by requesting optimization of arbitrarily large images. This vulnerability requires that
    `remotePatterns` is configured to allow image optimization from external domains and that the attacker can
    serve or control a large image on an allowed domain. Strongly consider upgrading to 15.5.10 or 16.1.5 to
    reduce risk and prevent availability issues in Next applications. (CVE-2025-59471)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns`     configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images     entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory     conditions by requesting optimization of arbitrarily large images. This vulnerability requires that     `remotePatterns` is configured to allow image optimization from external domains and that the attacker can     serve or control a large image on an allowed domain. Strongly consider upgrading to 15.5.10 or 16.1.5 to     reduce risk and prevent availability issues in Next applications. (CVE-2025-59471)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
297814	Next.js Framework 10.x / 11.x / 12.x / 13.x / 14.x / 15.x < 15.5.10 / 16.x < 16.1.5 Image Optimizer DoS (GHSA-9g9p-9gw9-jx7f)	Nessus	Misc.	high
437246	SCA: security update for next (GHSA-9g9p-9gw9-jx7f)	Tenable Cloud Security	SCA Checks	high
437246	SCA: security update for next (GHSA-9g9p-9gw9-jx7f)	Tenable Self-Hosted Container Security	SCA Checks	high
297051	Linux Distros Unpatched Vulnerability : CVE-2025-59471	Nessus	Misc.	high

Detections

Analytics

CVE-2025-59471

high

Tenable Plugins

high

high

high

high