Next.js Content Injection Vulnerability for Image Optimization
A vulnerability in **Next.js Image Optimization** has been fixed in **v15.4.5** and **v14.2.31**. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. All users relying on `images.domains` or `images.remotePatterns` are encouraged to upgrade and verify that external image sources are strictly validated. More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-55173)
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-55173US | — | — | ||
Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to cont… | ||||
references
External citations — patches, advisories, analysis.
- http://vercel.com/changelog/cve-2025-55173WEB
- https://github.com/vercel/next.jsPACKAGE
- https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422dddWEB
- https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8vWEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-55173ADVISORY
- https://vercel.com/changelog/cve-2025-55173WEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan