CVE-2025-55173

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-55173", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-08-07T18:27:23.309Z", "datePublished": "2025-08-29T22:00:05.765Z", "dateUpdated": "2025-09-02T19:22:57.504Z"}, "containers": {"cna": {"title": "Next.js Content Injection Vulnerability for Image Optimization", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v"}, {"name": "https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd", "tags": ["x_refsource_MISC"], "url": "https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd"}, {"name": "https://vercel.com/changelog/cve-2025-55173", "tags": ["x_refsource_MISC"], "url": "https://vercel.com/changelog/cve-2025-55173"}], "affected": [{"vendor": "vercel", "product": "next.js", "versions": [{"version": ">= 15.0.0, < 15.4.5", "status": "affected"}, {"version": "< 14.2.31", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-08-29T22:04:25.365Z"}, "descriptions": [{"lang": "en", "value": "Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5."}], "source": {"advisory": "GHSA-xv57-4mr9-wg8v", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-02T19:22:48.480499Z", "id": "CVE-2025-55173", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-02T19:22:57.504Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-55173", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-02T19:22:48.480499Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-02T19:22:53.153Z"}}], "cna": {"title": "Next.js Content Injection Vulnerability for Image Optimization", "source": {"advisory": "GHSA-xv57-4mr9-wg8v", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "vercel", "product": "next.js", "versions": [{"status": "affected", "version": ">= 15.0.0, < 15.4.5"}, {"status": "affected", "version": "< 14.2.31"}]}], "references": [{"url": "https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v", "name": "https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd", "name": "https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd", "tags": ["x_refsource_MISC"]}, {"url": "https://vercel.com/changelog/cve-2025-55173", "name": "https://vercel.com/changelog/cve-2025-55173", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-08-29T22:04:25.365Z"}}}, "cveMetadata": {"cveId": "CVE-2025-55173", "state": "PUBLISHED", "dateUpdated": "2025-09-02T19:22:57.504Z", "dateReserved": "2025-08-07T18:27:23.309Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-08-29T22:00:05.765Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "next.js", "vendor": "vercel", "versions": [{"status": "affected", "version": ">= 15.0.0, < 15.4.5"}, {"status": "affected", "version": "< 14.2.31"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "88CF5491-9D3E-4538-B7F4-9B2FACB57878", "versionEndExcluding": "14.2.31", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "2FE23799-8927-4736-934B-BC2BB6F9BB63", "versionEndExcluding": "15.4.5", "versionStartIncluding": "15.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5."}, {"lang": "es", "value": "Next.js es un React framework para construir aplicaciones web full-stack. En versiones antes de 14.2.31 y desde 15.0.0 hasta la 15.4.5, la optimizaci\u00f3n de im\u00e1genes de Next.js es vulnerable a la inyecci\u00f3n de contenido. El problema permiti\u00f3 que fuentes de im\u00e1genes externas controladas por el atacante desencadenaran descargas de archivos con contenido y nombres de archivo arbitrarios bajo configuraciones espec\u00edficas. Este comportamiento podr\u00eda ser abusado para phishing o entrega de archivos maliciosos. Esta vulnerabilidad ha sido corregida en las versiones de Next.js 14.2.31 y 15.4.5."}], "id": "CVE-2025-55173", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-55173", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-02T19:22:48.480499Z", "version": "2.0.3"}}]}, "published": "2025-08-29T22:15:31.750", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://vercel.com/changelog/cve-2025-55173"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "nextjs: Next.js Content Injection Vulnerability for Image Optimization", "id": "2392059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392059"}, "csaw": false, "cwe": "CWE-20", "details": ["Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5."], "mitigation": {"lang": "en:us", "value": "Mitigation includes restricting images.domains and images.remotePatterns to trusted hosts only, avoiding permissive configurations, and monitoring logs for suspicious image fetches."}, "name": "CVE-2025-55173", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "dotnet7.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:trusted_artifact_signer:1", "fix_state": "Fix deferred", "package_name": "rhtas/rekor-search-ui-rhel9", "product_name": "Red Hat Trusted Artifact Signer"}, {"cpe": "cpe:/a:redhat:amq_streams:2", "fix_state": "Fix deferred", "package_name": "com.github.streamshub-console", "product_name": "streams for Apache Kafka 2"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Fix deferred", "package_name": "com.github.streamshub-console", "product_name": "streams for Apache Kafka 3"}], "public_date": "2025-08-29T22:00:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-55173\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-55173\nhttps://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd\nhttps://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v\nhttps://vercel.com/changelog/cve-2025-55173"], "statement": "This issue is classified as Moderate rather than Important because exploitation requires a very specific set of conditions: the target Next.js app must be configured with permissive external image domains or patterns, the attacker must control or influence the remote image server, and a user must be tricked into clicking a crafted link. The vulnerability does not provide direct code execution, privilege escalation, or server compromise\u2014it primarily enables arbitrary file downloads, which increases the risk of phishing and social engineering rather than direct technical exploitation. Since the attack vector relies on user interaction and misconfiguration rather than a default behavior, the overall impact is contained, making it less severe than flaws that directly compromise application integrity or confidentiality.", "threat_severity": "Moderate"}

{"created": "2025-08-31T08:41:34.754634+00:00", "updated": "2025-08-31T08:41:34.754684+00:00", "vendors": ["vercel", "vercel$PRODUCT$next.js"]}