Next.js Content Injection Vulnerability for Image Optimization

中 4.3CVE-2025-55173 · GHSA-xv57-4mr9-wg8v · 29/08/2025 公開 · 18/10/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
next.js vercel	`≥ 15.0.0, < 15.4.5< 14.2.31`	`15.4.514.2.31`
next npm	`≥ 0.9.9, < 14.2.31≥ 15.0.0, < 15.4.5`	`14.2.3115.4.5`

概要

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery.

All users relying on images.domains or images.remotePatterns are encouraged to upgrade and verify that external image sources are strictly validated.

More details at Vercel Changelog

NVD の説明

Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5.

参考情報

vercel/next.js security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-55173 · ADVISORY
vercel/next.js commit 6b12c60 · WEB
vercel/next.js · PACKAGE
vercel.com/changelog/cve-2025-55173 · WEB
vercel.com/changelog/cve-2025-55173 · WEB

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン

パッケージ

影響を受けるバージョン

修正済みバージョン

next.js

vercel

≥ 15.0.0, < 15.4.5< 14.2.31

15.4.514.2.31

npm

≥ 0.9.9, < 14.2.31≥ 15.0.0, < 15.4.5

14.2.3115.4.5

概要

All users relying on images.domains or images.remotePatterns are encouraged to upgrade and verify that external image sources are strictly validated.

More details at Vercel Changelog

NVD の説明