# Information disclosure in Flags SDK (CVE-2025-46332) By Steven Van · 2025-05-02 A Flags SDK flaw (CVE-2025-46332) could expose flag names, descriptions and default values; Vercel mitigated it automatically and urges upgrading to flags@4.0.0. Vercel patched an information disclosure vulnerability in the [Flags SDK](), tracked as **CVE-2025-46332**, affecting flags ≤ 3.2.0 and @vercel/flags ≤ 3.1.1. Under specific conditions, a malicious actor could determine: - Flag names - Flag descriptions - Available options and their labels (for example true, false) - Default flag values Flags providers were not accessible, and no write access or additional customer data was exposed. Vercel has rolled out an automatic, network-level mitigation that blocks the default flags discovery endpoint at **/.well-known/vercel/flags**, which protects deployments without any action required. Teams exposing the discovery endpoint through a custom path, such as **/api/vercel/flags** under the Pages Router, or through distinct endpoints per app in a microfrontends setup, can add a custom WAF rule as an additional mitigation. Vercel recommends upgrading to **flags@4.0.0**, or migrating off @vercel/flags to the flags package, to fully remediate the issue. Until then, Flags Explorer is disabled and shows a warning notice. ![Vercel]() Vercel The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config. [View Vercel →]() [Original source]() [Read Information disclosure in Flags SDK (CVE-2025-46332) on Creators Toolbox]() --- Canonical source: https://creatorstoolbox.com/blog/vercel-information-disclosure-in-flags-sdk-cve-2025-46332