5 matches found
Dependency on Vulnerable Third-Party Component
Overview next is a react framework. Affected versions of this package are vulnerable to Dependency on Vulnerable Third-Party Component via the sharp image processing dependency used by next/image. A vulnerable version of sharp is bundled as an optional dependency, and an attacker can exploit a fl...
next.js: Next.js: Unbounded next/image disk cache growth can exhaust storage
An unbounded disk usage flaw has been discovered in Next.js. The default Next.js image optimization disk cache /next/image did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing...
CVE-2026-27980 Next.js: Unbounded next/image disk cache growth can exhaust storage
Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache /next/image did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many...
