Executive Summary
Two medium-severity Denial-of-Service (DoS) vulnerabilities, CVE-2025-59471 and CVE-2025-59472, have been discovered in self-hosted Next.js applications. These issues can cause server crashes through memory exhaustion when specific features—the Image Optimizer with external images or experimental Partial Pre-Rendering (PPR)—are enabled. The vulnerabilities do not allow for data exposure, and applications hosted on the Vercel platform are not affected. Patches have been released, and users of self-hosted instances are urged to upgrade.
Key Takeaways
* CVE-2025-59471 (Image Optimizer): This vulnerability affects applications using the `/_next/image` endpoint with `remotePatterns` configured. An attacker can use a very large image hosted on an allowed remote domain to trigger an out-of-memory condition and crash the server.
* CVE-2025-59472 (Partial Pre-Rendering): This affects applications with the experimental Partial Pre-Rendering (PPR) feature enabled in `minimal mode`. The PPR resume endpoint can be exploited with attacker-controlled data to cause memory exhaustion.
* Impact: Both vulnerabilities are rated as medium severity (CVSS 5.9) and can result in application downtime due to server termination. They do not lead to data exposure or privilege escalation.
* Affected Audience: The vulnerabilities only impact self-hosted Next.js deployments. Applications hosted on Vercel's managed platform are not affected and require no action.
* Resolution: Patches are available in versions `15.5.10`, `16.1.5`, and newer. Self-hosted users are advised to upgrade immediately or apply workarounds, such as restricting remote image patterns or disabling PPR.
Strategic Importance
This security bulletin reinforces the shared responsibility model for open-source software, highlighting the operational and security advantages of using the managed Vercel platform over self-hosting.