CVE-2025-55173

Overview

Next.js is a React framework for building web applications.

‍CVE-2025-55173 is a vulnerability in the Image Optimization feature that affects applications with configured external image domains or patterns. The vulnerability allows malicious actors to exploit the image optimization service to trigger arbitrary file downloads with attacker-controlled content and filenames.

Under certain configurations (images.domains or permissive images.remotePatterns), an attacker could leverage crafted responses from external image servers to bypass content type validation, potentially leading to phishing attacks, drive-by downloads, or social engineering scenarios.

Per OWASP: Content spoofing, also referred to as content injection, “arbitrary text injection” or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. When an application does not properly handle user-supplied data, an attacker can supply content to a web application, typically via a parameter value, that is reflected back to the user. This presents the user with a modified page under the context of the trusted domain. This attack is typically used as, or in conjunction with, social engineering because the attack is exploiting a code-based vulnerability and a user’s trust.

This issue affects all versions of Next.js less than 14.2.31 and 15.x versions less than 15.4.5.

‍

Details

Module Info

• Product: Next.js
• Affected packages: next
• Affected versions: <14.2.31, >=15.0.0 <15.4.5
• GitHub repository: http://github.com/vercel/next.js
• Published packages: https://www.npmjs.com/package/next
• Package manager: npm
• Fixed in: NES for Next.js v12.3.11

‍

Vulnerability Info

This Medium-severity vulnerability is found in the Image Optimization feature of the Next.js framework in the affected versions.

The vulnerability stems from improper content type validation in the image optimization service. When detectContentType() fails to identify the content type through magic number detection, the vulnerable code falls back to trusting the upstream Content-Type header without proper validation:

An attacker can exploit this by:

1. Configuring a malicious external image server that serves non-image content
2. Setting crafted Content-Type headers that bypass image validation
3. Triggering the download of arbitrary files with attacker-controlled content and filenames
4. Potentially using this for phishing, drive-by downloads, or social engineering attacks

The vulnerability requires that the target application has external image domains or patterns configured via images.domains or images.remotePatterns.

‍

Mitigation

Next.js v13 and older versions have reached End-of-Life and will not receive any updates to address this issue.

Users of the affected components should apply one of the following mitigations:’

• Migrate to the latest version of Next.js
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• kristianmagas

‍