Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. This is fixed in version 16.1.7 by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. If upgrading is not immediately possible, periodically clean `.next/cache/images` and/or reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`).

The Next.js Framework on the remote host is affected by a denial of service vulnerability:

  - A denial of service vulnerability exists in the Next.js image optimization feature which lacks a     configurable upper limit on disk cache size. An attacker can deliberately generate many unique     image-optimization variants and exhaust disk space, causing the cache to grow without bounds and     potentially exhausting available disk storage. (CVE-2026-27980)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and
    prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a
    configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-
    optimization variants and exhaust disk space, causing denial of service. This is fixed in version 16.1.7
    by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-
    recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching.
    If upgrading is not immediately possible, periodically clean `.next/cache/images` and/or reduce variant
    cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and
    `images.qualities`). (CVE-2026-27980)

ID	Name	Product	Family	Type	Severity
303200	Next.js Framework 10.x / 11.x / 12.x / 13.x / 14.x / 15.x / 16.x < 16.1.7 Image Optimizer Disk Cache DoS (GHSA-3x4c-7xq6-9pq8)	Nessus	Misc.	Local	medium
438896	SCA: security update for next (GHSA-3x4c-7xq6-9pq8)	Tenable Cloud Security	SCA Checks	Local	medium
438896	SCA: security update for next (GHSA-3x4c-7xq6-9pq8)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-27980

medium

Tenable Plugins

medium

medium

medium