CVE-2025-57752 in next.js
Summary
by MITRE • 08/30/2025
Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization API routes are affected by cache key confusion. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5. All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/05/2025
The vulnerability described in CVE-2025-57752 represents a critical cache key confusion issue within Next.js Image Optimization API routes that directly impacts the security and integrity of web applications built using this framework. This flaw specifically affects versions prior to 14.2.31 and between 15.0.0 and 15.4.5, creating a scenario where sensitive content could be improperly cached and served to unauthorized users. The vulnerability stems from the framework's handling of cache keys when processing images that depend on request headers such as Cookie or Authorization, which are commonly used for authentication and access control mechanisms.
The technical implementation of this vulnerability involves a fundamental flaw in how Next.js generates cache keys for API route responses when image optimization is enabled. When API routes serve images that vary based on request headers, the framework should create unique cache entries for each distinct combination of headers to ensure proper isolation between different user sessions or authentication states. However, due to the cache key confusion bug, the system incorrectly reuses or confuses cache entries, leading to situations where responses intended for one user or authentication context are served to different users. This behavior directly violates the principle of least privilege and can result in information disclosure, where authenticated users may access content that should be restricted to other users or roles.
From an operational impact perspective, this vulnerability creates a significant security risk for applications that rely on Next.js Image Optimization API routes for serving personalized or protected content. The flaw essentially allows for cache poisoning attacks where malicious actors could potentially exploit the confusion in cache key generation to gain access to content that should be restricted. This is particularly concerning for applications that serve user-specific images, profile pictures, or any content that varies based on authentication headers. The vulnerability's impact is amplified when applications use cookie-based authentication or token-based authorization systems, as these headers are commonly processed by the Image Optimization API routes, making the attack surface more extensive.
The mitigation strategy for this vulnerability requires immediate upgrading of Next.js applications to versions 14.2.31 or 15.4.5, where the cache key confusion bug has been resolved. Organizations should also conduct thorough security reviews of their applications to identify all API routes that serve images based on request headers, particularly those that handle authentication tokens or cookies. Additionally, implementing proper cache control headers and ensuring that sensitive image content is not cached inappropriately can provide additional defense-in-depth measures. This vulnerability aligns with CWE-200 (Information Exposure) and CWE-353 (Missing Support for Integrity Check) categories, and represents a clear violation of the principle of secure cache management as outlined in the OWASP Top Ten. The ATT&CK framework categorizes this issue under T1566 (Phishing) and T1071.004 (Application Layer Protocol: DNS) when considering the broader impact of compromised content delivery, as attackers could exploit this to serve malicious content or gain unauthorized access to protected resources through cache manipulation.