Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-xv57-4mr9-wg8v: Next.js Content Injection Vulnerability for Image Optimization

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery.

All users relying on images.domains or images.remotePatterns are encouraged to upgrade and verify that external image sources are strictly validated.

More details at Vercel Changelog

ghsa
#vulnerability#web#js#git#intel

Skip to content

Navigation Menu

    • GitHub Copilot

      Write better code with AI

    • GitHub Spark New

      Build and deploy intelligent apps

    • GitHub Models New

      Manage and compare prompts

    • GitHub Advanced Security

      Find and fix vulnerabilities

    • Actions

      Automate any workflow

*   Codespaces
    
    Instant dev environments
    
*   Issues
    
    Plan and track work
    
*   Code Review
    
    Manage code changes
    
*   Discussions
    
    Collaborate outside of code
    
*   Code Search
    
    Find more, search less
  • Explore

    • Learning Pathways
    • Events & Webinars
    • Ebooks & Whitepapers
    • Customer Stories
    • Partners
    • Executive Insights
    • GitHub Sponsors

      Fund open source developers

*   The ReadME Project
    
    GitHub community articles
    • Enterprise platform

      AI-powered developer platform

  • Pricing

Provide feedback

Saved searches****Use saved searches to filter your results more quickly

Sign up

Appearance settings

  1. GitHub Advisory Database
  2. GitHub Reviewed
  3. CVE-2025-55173

Next.js Content Injection Vulnerability for Image Optimization

Moderate severity GitHub Reviewed Published Aug 29, 2025 in vercel/next.js • Updated Aug 29, 2025

Affected versions

< 14.2.31

>= 15.0.0, <= 15.4.4

Patched versions

14.2.31

15.4.5

Description

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery.

All users relying on images.domains or images.remotePatterns are encouraged to upgrade and verify that external image sources are strictly validated.

More details at Vercel Changelog

References

  • GHSA-xv57-4mr9-wg8v
  • vercel/next.js@6b12c60
  • http://vercel.com/changelog/cve-2025-55173

Published to the GitHub Advisory Database

Aug 29, 2025

Last updated

Aug 29, 2025

EPSS score

ghsa: Latest News

GHSA-g5qg-72qw-gw5v: Next.js Affected by Cache Key Confusion for Image Optimization API Routes