Unbounded Disk Cache Flaw in Next.js Framework from Vercel

CVE-2026-27980

What is CVE-2026-27980?

The Next.js framework, used for building full-stack web applications, has a vulnerability in its default image optimization disk cache that allows unbounded growth. This flaw, present in versions 10.0.0 to 16.1.6, could be exploited by an attacker to create numerous unique image-optimization variants, ultimately exhausting disk space and leading to a denial of service. The vulnerability has been addressed in version 16.1.7, which incorporates an LRU-backed disk cache with a configurable maximum size, ensuring that the cache does not grow uncontrollably. To secure your applications, it is advised to upgrade to the latest version or implement strategies to manage cache size effectively.

References