GHSA-xv57-4mr9-wg8v

Next.js Content Injection Vulnerability for Image Optimization

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-55173

Packages

Ecosystem	Package	Affected	Fixed in
npm	next	>= 0.9.9, < 14.2.31	14.2.31
npm	next	>= 15.0.0, < 15.4.5	15.4.5

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability in **Next.js Image Optimization** has been fixed in **v15.4.5** and **v14.2.31**. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. All users relying on `images.domains` or `images.remotePatterns` are encouraged to upgrade and verify that external image sources are strictly validated. More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-55173)

References

External links from the advisory. They lead to third-party sites.

https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v web
https://nvd.nist.gov/vuln/detail/CVE-2025-55173 advisory
https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd web
https://github.com/vercel/next.js package
https://vercel.com/changelog/cve-2025-55173 web
http://vercel.com/changelog/cve-2025-55173 web