# CVE-2025-55173

By Steven Van · 2025-08-29

Attacker-controlled image servers could trigger disguised file downloads in Next.js; Vercel-hosted apps were patched in July, self-hosted ones need to upgrade.

A vulnerability in [Vercel](<https://creatorstoolbox.com/tools/vercel>)'s Next.js Image Optimization, [CVE-2025-55173](<https://github.com/vercel/next.js/releases>), let attacker-controlled external image servers return crafted responses that triggered file downloads with an attacker-chosen filename and content, in versions before v15.4.5 and v14.2.31.

Exploiting it required an app configured with external image domains (via *images.domains* or a permissive *images.remotePatterns*), an attacker-controlled or attacker-influenced remote server, and a user tricked into clicking a crafted URL. Under those conditions, the flaw could be used for phishing, drive-by downloads, or other social engineering.

Vercel-hosted deployments were already protected by a patch applied on July 29, 2025. Self-hosted deployments should upgrade to v15.4.5 or v14.2.31, which stop the image optimizer from falling back to the upstream server's Content-Type header when magic number detection fails.

[![](<https://repository-images.githubusercontent.com/70107786/4602445c-10a2-4903-a360-c96d70531f67>)](<https://github.com/vercel/next.js/releases>)

![Vercel](<https://www.google.com/s2/favicons?domain=vercel.com&sz=128>)

Vercel

The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.

[View Vercel →](<https://creatorstoolbox.com/tools/vercel>)

[Original source](<https://github.com/vercel/next.js/releases>)

[Read CVE-2025-55173 on Creators Toolbox](<https://creatorstoolbox.com/blog/vercel-cve-2025-55173>)

---
Canonical source: https://creatorstoolbox.com/blog/vercel-cve-2025-55173