GHSA-g5qg-72qw-gw5v

Next.js Affected by Cache Key Confusion for Image Optimization API Routes

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-57752

Packages

Ecosystem	Package	Affected	Fixed in
npm	next	>= 0.9.9, < 14.2.31	14.2.31
npm	next	>= 15.0.0, < 15.4.5	15.4.5

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as `Cookie` or `Authorization`), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug. All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled. More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57752)

References

External links from the advisory. They lead to third-party sites.

https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v web
https://nvd.nist.gov/vuln/detail/CVE-2025-57752 advisory
https://github.com/vercel/next.js/pull/82114 web
https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd web
https://github.com/vercel/next.js package
https://vercel.com/changelog/cve-2025-57752 web