CVE-2025-55173
By Steven Van ·
Attacker-controlled image servers could trigger disguised file downloads in Next.js; Vercel-hosted apps were patched in July, self-hosted ones need to upgrade.
A vulnerability in Vercel's Next.js Image Optimization, CVE-2025-55173, let attacker-controlled external image servers return crafted responses that triggered file downloads with an attacker-chosen filename and content, in versions before v15.4.5 and v14.2.31.
Exploiting it required an app configured with external image domains (via images.domains or a permissive images.remotePatterns), an attacker-controlled or attacker-influenced remote server, and a user tricked into clicking a crafted URL. Under those conditions, the flaw could be used for phishing, drive-by downloads, or other social engineering.
Vercel-hosted deployments were already protected by a patch applied on July 29, 2025. Self-hosted deployments should upgrade to v15.4.5 or v14.2.31, which stop the image optimizer from falling back to the upstream server's Content-Type header when magic number detection fails.