{"action":"Upgrade next to 15.5.21 or later.","affected":[{"fixed":"15.5.21","introduced":"15.5.0"},{"fixed":"16.2.11","introduced":"16.0.0"}],"component":"next","cve_ids":["CVE-2026-64644"],"ecosystem":"npm","epss":0.00666,"exploited":false,"fixed_versions":["15.5.21","16.2.11"],"ghsa_id":"GHSA-q8wf-6r8g-63ch","id":"tcs_01M5KG5QHHQSFA2YCDZ3S1D7WN","modified_at":"2026-09-10T03:50:52.922204835Z","published_at":"2026-07-22T23:02:05Z","references":["https://osv.dev/vulnerability/GHSA-q8wf-6r8g-63ch","https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch","https://github.com/vercel/next.js/pull/96006","https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c","https://github.com/vercel/next.js","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-q8wf-6r8g-63ch","url":"https://osv.dev/vulnerability/GHSA-q8wf-6r8g-63ch"}],"summary":"Next.js: Denial of Service in the Image Optimization API using SVGs"}