Unbounded Disk Cache Flaw in Next.js Framework from Vercel
CVE-2026-27980
What is CVE-2026-27980?
The Next.js framework, used for building full-stack web applications, has a vulnerability in its default image optimization disk cache that allows unbounded growth. This flaw, present in versions 10.0.0 to 16.1.6, could be exploited by an attacker to create numerous unique image-optimization variants, ultimately exhausting disk space and leading to a denial of service. The vulnerability has been addressed in version 16.1.7, which incorporates an LRU-backed disk cache with a configurable maximum size, ensuring that the cache does not grow uncontrollably. To secure your applications, it is advised to upgrade to the latest version or implement strategies to manage cache size effectively.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
next.js >= 10.0.0, < 16.1.7