GitHub Advisoryadvisory · npm

GHSA-xv57-4mr9-wg8v Next.js Content Injection Vulnerability for Image Optimization

MEDIUM Published 2025-08-29 Modified 2025-09-11 Official page ↗
Aliases
CVE-2025-55173
Ecosystem
npm
Packages
next
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-20
Reviewed
2025-08-29

Affected packages

• npm next: >= 0.9.9, < 14.2.31 → fixed in 14.2.31 • npm next: >= 15.0.0, < 15.4.5 → fixed in 15.4.5

Description

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. All users relying on `images.domains` or `images.remotePatterns` are encouraged to upgrade and verify that external image sources are strictly validated. More details at Vercel Changelog

Related

Alias · CVE (1)

  • CVE-2025-55173 Next.js is a React framework for building full-stack web applications. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References