An unauthenticated remote attacker can cause a denial of service in Next.js applications by exhausting server disk space through unbounded image optimization cache growth.

The vulnerability is an uncontrolled resource consumption flaw (CWE-400) located in the default image optimization disk cache (/_next/image). An unauthenticated attacker can trigger the creation of numerous unique image variants, causing the disk cache to grow indefinitely until storage capacity is depleted.

The exploitation of this vulnerability results in service unavailability, which can disrupt business operations and impact user access to web applications. With a CVSS score of 7.5, the risk is classified as High due to the ease of exploitation and the potential for significant operational downtime. This flaw poses a direct threat to the availability of external-facing digital services.

Immediate Action: Upgrade to Next.js version 16.1.7 or 15.5.14 to implement the new LRU-backed disk cache and configurable limits.

Proactive Monitoring: Monitor server disk usage and alert on rapid growth within the .next/cache/images directory.

Compensating Controls: If upgrading is not immediately feasible, manually clear the .next/cache/images directory periodically and restrict image optimization parameters using images.localPatterns and images.remotePatterns to reduce variant cardinality.

Public Exploit Available: Unknown

Given the ease with which an unauthenticated attacker can induce a denial of service, administrators must prioritize updating to the patched versions of Next.js. Implementing the maximumDiskCacheSize configuration is essential to prevent future resource exhaustion and ensure the long-term stability of the application environment.