# CVE-2025-57752

By Steven Van · 2025-08-29

A Next.js Image Optimization bug could cache and serve one user's protected images to another; fixed in v15.4.5 and v14.2.31.

A vulnerability in Next.js Image Optimization allowed cached images to leak between users. When an API route returned image content that varied by request header, such as **Cookie** or **Authorization**, and that image passed through Next.js Image Optimization, the optimized result could be cached without those headers as part of the cache key. That let a cached, user-specific or protected image be served to a different, unauthorized user via the CDN or an internal cache. No user interaction or elevated privileges were required, only a prior authorized request to populate the cache.

The issue was fixed by no longer forwarding request headers to the proxied request to the image endpoint, so the endpoint can't be used to serve images that require authorization data. [Vercel](<https://creatorstoolbox.com/tools/vercel>) deployments were never affected. The fix is in Next.js v15.4.5 and v14.2.31; the [advisory is on GitHub](<https://github.com/vercel/next.js/releases>).

[![](<https://repository-images.githubusercontent.com/70107786/4602445c-10a2-4903-a360-c96d70531f67>)](<https://github.com/vercel/next.js/releases>)

![Vercel](<https://www.google.com/s2/favicons?domain=vercel.com&sz=128>)

Vercel

The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.

[View Vercel →](<https://creatorstoolbox.com/tools/vercel>)

[Original source](<https://github.com/vercel/next.js/releases>)

[Read CVE-2025-57752 on Creators Toolbox](<https://creatorstoolbox.com/blog/vercel-cve-2025-57752>)

---
Canonical source: https://creatorstoolbox.com/blog/vercel-cve-2025-57752