CVE-2025-55173

{
  "id": "CVE-2025-55173",
  "sourceIdentifier": "[email protected]",
  "published": "2025-08-29T22:15:31.750",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5."
    },
    {
      "lang": "es",
      "value": "Next.js es un React framework para construir aplicaciones web full-stack. En versiones antes de 14.2.31 y desde 15.0.0 hasta la 15.4.5, la optimización de imágenes de Next.js es vulnerable a la inyección de contenido. El problema permitió que fuentes de imágenes externas controladas por el atacante desencadenaran descargas de archivos con contenido y nombres de archivo arbitrarios bajo configuraciones específicas. Este comportamiento podría ser abusado para phishing o entrega de archivos maliciosos. Esta vulnerabilidad ha sido corregida en las versiones de Next.js 14.2.31 y 15.4.5."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "vercel",
          "product": "next.js",
          "versions": [
            {
              "version": ">= 15.0.0, < 15.4.5",
              "status": "affected"
            },
            {
              "version": "< 14.2.31",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-02T19:22:48.480499Z",
          "id": "CVE-2025-55173",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
              "versionEndExcluding": "14.2.31",
              "matchCriteriaId": "88CF5491-9D3E-4538-B7F4-9B2FACB57878"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
              "versionStartIncluding": "15.0.0",
              "versionEndExcluding": "15.4.5",
              "matchCriteriaId": "2FE23799-8927-4736-934B-BC2BB6F9BB63"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://vercel.com/changelog/cve-2025-55173",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}