CVE-2025-55173 - CVE House

Back to Database

Status published Medium CVE-2025-55173

Next.js Content Injection Vulnerability for Image Optimization

4.3 CVSS

Vulnerability Description

Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-55173

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from vercel

View All →

vercel hyper rimraf-standalone.js ignoreMap redos

A denial of service vulnerability exists in Next.js versions with...

A denial of service vulnerability exists in self-hosted Next.js applications...

Next.js Improper Middleware Redirect Handling Leads to SSRF

Next.js Affected by Cache Key Confusion for Image Optimization API Routes

Affected Vendor

vercel

View all reports →

Affected Software

next.js

Vulnerable Versions:

>= 15.0.0, < 15.4.5, < 14.2.31

Timeline

Official Publish: August 29th, 2025

Last Modified: September 2nd, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation