CVE-2025-57752
By Steven Van ·
A Next.js Image Optimization bug could cache and serve one user's protected images to another; fixed in v15.4.5 and v14.2.31.
A vulnerability in Next.js Image Optimization allowed cached images to leak between users. When an API route returned image content that varied by request header, such as Cookie or Authorization, and that image passed through Next.js Image Optimization, the optimized result could be cached without those headers as part of the cache key. That let a cached, user-specific or protected image be served to a different, unauthorized user via the CDN or an internal cache. No user interaction or elevated privileges were required, only a prior authorized request to populate the cache.
The issue was fixed by no longer forwarding request headers to the proxied request to the image endpoint, so the endpoint can't be used to serve images that require authorization data. Vercel deployments were never affected. The fix is in Next.js v15.4.5 and v14.2.31; the advisory is on GitHub.