Allocation of Resources Without Limits or Throttling

Summary

Next.js is a React framework for building full-stack web applications. In versions from 10.0.0 prior to 15.5.16 and 16.x prior to 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the '/_next/image' endpoint that match the 'images.localPatterns' configuration (by default, all patterns are allowed).