Next.js Content Injection Vulnerability for Image Optimization
A vulnerability in **Next.js Image Optimization** has been fixed in **v15.4.5** and **v14.2.31**. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. All users relying on `images.domains` or `images.remotePatterns` are encouraged to upgrade and verify that external image sources are strictly validated. More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-55173)
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-55173US | — | — | ||
Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to cont… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://vercel.com/changelog/cve-2025-55173WEB
- https://github.com/vercel/next.jsPACKAGE
- https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422dddWEB
- https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8vWEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-55173ADVISORY
- https://vercel.com/changelog/cve-2025-55173WEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan