{"action":"Upgrade next to 15.5.10 or later.","affected":[{"fixed":"15.5.10","introduced":"10.0.0"},{"fixed":"16.1.5","introduced":"15.6.0-canary.0"}],"component":"next","cve_ids":["CVE-2025-59471"],"ecosystem":"npm","epss":0.00487,"exploited":false,"fixed_versions":["15.5.10","16.1.5"],"ghsa_id":"GHSA-9g9p-9gw9-jx7f","id":"tcs_01M5KFFT5RNPR24VBE5EVQSZ7R","modified_at":"2026-09-10T03:50:59.013924260Z","published_at":"2026-01-27T19:18:25Z","references":["https://osv.dev/vulnerability/GHSA-9g9p-9gw9-jx7f","https://github.com/vercel/next.js/security/advisories/GHSA-9g9p-9gw9-jx7f","https://nvd.nist.gov/vuln/detail/CVE-2025-59471","https://github.com/vercel/next.js/commit/500ec83743639addceaede95e95913398975156c","https://github.com/vercel/next.js/commit/e5b834d208fe0edf64aa26b5d76dcf6a176500ec","https://github.com/vercel/next.js","https://github.com/vercel/next.js/releases/tag/v15.5.10","https://github.com/vercel/next.js/releases/tag/v16.1.5"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-9g9p-9gw9-jx7f","url":"https://osv.dev/vulnerability/GHSA-9g9p-9gw9-jx7f"}],"summary":"Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration"}