HuntersHunters
Sign inStart free
Security context
Medium· 4.3GHSA-xv57-4mr9-wg8v CVE-2025-55173CWE-20Published Aug 29, 2025

Next.js Content Injection Vulnerability for Image Optimization

Research this vulnerability

Research is free — Hunters explains how the bug works, the root-cause code pattern, how the fix addresses it, and how to test whether a target is affected, in chat. Investigate & write exploit is a paid run — the engine reads the advisory and fix commits, then builds and validates a working proof-of-concept exploit with reproduction steps.

Affected versions

0.9.9 → fixed in 14.2.3115.0.0 → fixed in 15.4.5

Details

A vulnerability in **Next.js Image Optimization** has been fixed in **v15.4.5** and **v14.2.31**. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. All users relying on `images.domains` or `images.remotePatterns` are encouraged to upgrade and verify that external image sources are strictly validated. More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-55173)

The fix

fix(next/image): fix image-optimizer.ts headers (#82114)

Steven· Jul 28, 2025, 01:06 PM+18−16b12c60c61
packages/next/src/server/image-optimizer.ts+0 −1
@@ -634,7 +634,6 @@ export async function fetchInternalImage(
     const mocked = createRequestResponseMocks({
       url: href,
       method: _req.method || 'GET',
-      headers: _req.headers,
       socket: _req.socket,
     })
test/integration/image-optimizer/app/pages/api/conditional-cookie.js+11 −0
@@ -0,0 +1,11 @@
+const pixel =
+  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPj/HwADBwIAMCbHYQAAAABJRU5ErkJggg=='
+ 
+export default function handler(req, res) {
+  if (req.headers['cookie']) {
+    res.setHeader('content-type', 'image/png')
+    res.end(Buffer.from(pixel, 'base64'))
+  } else {
+    res.status(401).end('cookie was not found')
+  }
+}
test/integration/image-optimizer/test/util.ts+7 −0
@@ -308,6 +308,13 @@ export function runTests(ctx: RunTestsCtx) {
     expect(ctx.nextOutput).toContain(animatedWarnText)
   })
  
+  it('should not forward cookie header', async () => {
+    const query = { w: ctx.w, q: 30, url: '/api/conditional-cookie' }
+    const opts = { headers: { accept: 'image/webp', cookie: '1' } }
+    const res = await fetchViaHTTP(ctx.appPort, '/_next/image', query, opts)
+    expect(res.status).toBe(400)
+  })
+ 
   if (ctx.nextConfigImages?.dangerouslyAllowSVG) {
     it('should maintain vector svg', async () => {
       const query = { w: ctx.w, q: 90, url: '/test.svg' }

References