Next.js Framework 15.5.x < 15.5.21 / 16.x < 16.2.11 Image Optimization API DoS (GHSA-q8wf-6r8g-63ch)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(342580);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/03");

  script_cve_id("CVE-2026-64644");

  script_name(english:"Next.js Framework 15.5.x < 15.5.21 / 16.x < 16.2.11 Image Optimization API DoS (GHSA-q8wf-6r8g-63ch)");

  script_set_attribute(attribute:"synopsis", value:
"The Next.js Framework on the remote host is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Next.js Framework on the remote host is affected by a denial of service vulnerability:

  - When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely
    hosted images if configured (not enabled by default). If those images contain malicious content, they can
    cause CPU exhaustion in /_next/image endpoints. Only config.images.remotePatterns is affected, and just
    the patterns in that array, whereas config.images.unoptimized: true, config.images.loader: 'custom', and
    Vercel are not impacted. (CVE-2026-64644)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  # https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c5b31cc1");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Next.js Framework version 15.5.21 or 16.2.11 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-64644");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/03");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vercel:next.js");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

get_kb_item_or_exit('Host/nodejs/modules/enumerated');

vcf::add_separator('-');
vcf::add_conversions({'canary':-25});

var app_info = vcf_extras::nodejs_modules::get_app_info(app:'next');

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, 'next');

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  {'min_version':'15.5.0', 'fixed_version':'15.5.21'},
  {'min_version':'16.0.0', 'fixed_version':'16.2.11'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);