VYPR
← All advisories
Moderate severityNVD Advisory· Published Aug 29, 2025· Updated Sep 2, 2025

Next.js Content Injection Vulnerability for Image Optimization

CVE-2025-55173

Description

Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
nextnpm
>= 0.9.9, < 14.2.3114.2.31
nextnpm
>= 15.0.0, < 15.4.515.4.5

Affected products

14

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.