Summaries of CVE-2025-59471 and CVE-2025-59472
By Steven Van ·
Two CVSS 5.9 flaws let attackers crash self-hosted Next.js servers via memory exhaustion; Vercel-hosted apps are unaffected.
Two denial-of-service vulnerabilities have been found in self-hosted Next.js applications, both able to crash the Node.js process through memory exhaustion. Vercel says applications hosted on its own platform aren't affected and require no customer action; neither vulnerability allows data exposure or privilege escalation.
- CVE-2025-59471 (CVSS 5.9) affects the Image Optimizer when external image optimization is enabled via remotePatterns. The /_next/image endpoint loads remote images fully into memory without enforcing a maximum size, letting an attacker trigger out-of-memory conditions with a very large image hosted on an allowed domain. It affects Next.js versions 10 through 15.5.10 and 16 through 16.1.5.
- CVE-2025-59472 (CVSS 5.9) affects applications running Partial Pre-Rendering in minimal mode, with experimental.ppr: true or cacheComponents: true set alongside the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable. Its PPR resume endpoint accepts unauthenticated POST requests and processes attacker-controlled data, allowing memory exhaustion through unbounded request buffering or decompression. It affects Next.js versions 15 through 15.6.0-canary.61 and 16 through 16.1.5.
Both are fixed in Next.js 15.5.10, 15.6.0-canary.61, 16.1.5 and 16.2.0-canary.9. Self-hosted deployments that can't upgrade immediately can restrict or remove untrusted remotePatterns entries, disable Partial Pre-Rendering or minimal mode, or apply strict request size limits at the reverse proxy layer. Vercel credited Andrew MacPherson for disclosing both issues through its bug bounty program; full details are in the advisory.
