{"id":"GHSA-xv57-4mr9-wg8v","revision":"399214659fec4abfac58d9931497736c","records":[{"revision":"399214659fec4abfac58d9931497736c","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-xv57-4mr9-wg8v","aliases":["CVE-2025-55173"],"title":"Next.js Content Injection Vulnerability for Image Optimization","description":"A vulnerability in **Next.js Image Optimization** has been fixed in **v15.4.5** and **v14.2.31**. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery.\n\nAll users relying on `images.domains` or `images.remotePatterns` are encouraged to upgrade and verify that external image sources are strictly validated.\n\nMore details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-55173)","state":0,"publishedAt":"2025-08-29T21:59:55+00:00","modifiedAt":"2026-09-10T03:50:27.7155662+00:00","affected":[{"ecosystem":"npm","name":"next","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.9.9"},{"kind":"fixed","version":"14.2.31"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"next","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"15.0.0"},{"kind":"fixed","version":"15.4.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v","https://nvd.nist.gov/vuln/detail/CVE-2025-55173","https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd","https://github.com/vercel/next.js","https://vercel.com/changelog/cve-2025-55173","http://vercel.com/changelog/cve-2025-55173"],"sourceUrl":"https://github.com/advisories/GHSA-xv57-4mr9-wg8v","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-xv57-4mr9-wg8v","identifiers":["GHSA-xv57-4mr9-wg8v","CVE-2025-55173"]},"retained":false,"historicalAffected":[]}],"coverage":[]}