{"id":"GHSA-g5qg-72qw-gw5v","revision":"f89af8bb28484f3cae20a7f10b5e911a","records":[{"revision":"f89af8bb28484f3cae20a7f10b5e911a","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-g5qg-72qw-gw5v","aliases":["CVE-2025-57752"],"title":"Next.js Affected by Cache Key Confusion for Image Optimization API Routes","description":"A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as `Cookie` or `Authorization`), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug.\n\nAll users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.\n\nMore details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57752)","state":0,"publishedAt":"2025-08-29T22:06:22+00:00","modifiedAt":"2026-09-10T03:50:26.9531686+00:00","affected":[{"ecosystem":"npm","name":"next","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.9.9"},{"kind":"fixed","version":"14.2.31"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"next","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"15.0.0"},{"kind":"fixed","version":"15.4.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v","https://nvd.nist.gov/vuln/detail/CVE-2025-57752","https://github.com/vercel/next.js/pull/82114","https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd","https://github.com/vercel/next.js","https://vercel.com/changelog/cve-2025-57752"],"sourceUrl":"https://github.com/advisories/GHSA-g5qg-72qw-gw5v","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-g5qg-72qw-gw5v","identifiers":["GHSA-g5qg-72qw-gw5v","CVE-2025-57752"]},"retained":false,"historicalAffected":[]}],"coverage":[]}