Executive brief
Next.js Image Optimization is a feature that processes and caches images referenced in Next.js web applications. A vulnerability allows attackers to trigger malicious file downloads with arbitrary content and filenames when external image sources are used, enabling phishing attacks or delivery of malicious software. The issue affects applications using images.domains or images.remotePatterns configuration without strict validation of external sources.
Technical details
This is a content injection vulnerability (CWE-20) in Next.js Image Optimization that allows attackers to control file download content and filenames through attacker-controlled external image sources. The vulnerability is triggered when Next.js processes images from external domains specified via images.domains or images.remotePatterns configuration. Exploitation requires user interaction (clicking a link) and network access; no authentication or special privileges are required. An attacker can deliver arbitrary files with arbitrary names under specific configurations, facilitating phishing or malware distribution. The vulnerability has been patched in Next.js v14.2.31 and v15.4.5; all users of affected versions should upgrade and validate external image sources.
Affected products
- Vercel Next.js before 14.2.31; 15.0.0 before 15.4.5
Timeline
- 2025-08-29: disclosed: Published in GitHub Security Advisory GHSA-xv57-4mr9-wg8v and CVE-2025-55173
- 2025-08-29: patched: Fixed in Next.js v14.2.31 and v15.4.5