CVE-2025-57752

A cache key confusion vulnerability in Next.js Image Optimization API could cause header-dependent images (e.g., using Cookie or Authorization) to be incorrectly cached and served to unauthorized users.

Binary-Affected: Next.js Upstream-version-introduced: v14.2.30 Upstream-version-fixed: v15.4.5 and v14.2.31

This vulnerability is considered Moderate because it only impacts applications that both (1) serve images through API routes where responses vary based on sensitive request headers, and (2) have image optimization enabled. In most common Next.js deployments, static images or header-independent responses are used, meaning the bug has no effect. Additionally, the exposure is limited to cached image content rather than direct access to underlying APIs or application data. Since it does not allow arbitrary code execution, privilege escalation, or broad data leakage by default, the impact is constrained to specific configurations, making it a Moderate issue rather than a Important flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

As a mitigation, developers/admins should avoid serving images that depend on sensitive request headers (such as Cookie or Authorization) through the Image Optimization API. Instead, these images can be served directly without optimization or with caching disabled to prevent unintended exposure to unauthorized users.