Information disclosure in Flags SDK (CVE-2025-46332)
By Steven Van ·
A Flags SDK flaw (CVE-2025-46332) could expose flag names, descriptions and default values; Vercel mitigated it automatically and urges upgrading to flags@4.0.0.
Vercel patched an information disclosure vulnerability in the Flags SDK, tracked as CVE-2025-46332, affecting flags ≤ 3.2.0 and @vercel/flags ≤ 3.1.1. Under specific conditions, a malicious actor could determine:
- Flag names
- Flag descriptions
- Available options and their labels (for example true, false)
- Default flag values
Flags providers were not accessible, and no write access or additional customer data was exposed. Vercel has rolled out an automatic, network-level mitigation that blocks the default flags discovery endpoint at /.well-known/vercel/flags, which protects deployments without any action required. Teams exposing the discovery endpoint through a custom path, such as /api/vercel/flags under the Pages Router, or through distinct endpoints per app in a microfrontends setup, can add a custom WAF rule as an additional mitigation.
Vercel recommends upgrading to flags@4.0.0, or migrating off @vercel/flags to the flags package, to fully remediate the issue. Until then, Flags Explorer is disabled and shows a warning notice.