CVE-2025-55173
Description
A vulnerability in Next.js Image Optimization allowed attacker-controlled image servers to trigger arbitrary file downloads with custom content and filenames. Exploitation required permissive images.domains or images.remotePatterns and user interaction.
Binary-Affected: Next.js Upstream-version-introduced: v14.2.30 Upstream-version-fixed: v15.4.5 and v14.2.31
Statement
This issue is classified as Moderate rather than Important because exploitation requires a very specific set of conditions: the target Next.js app must be configured with permissive external image domains or patterns, the attacker must control or influence the remote image server, and a user must be tricked into clicking a crafted link. The vulnerability does not provide direct code execution, privilege escalation, or server compromise—it primarily enables arbitrary file downloads, which increases the risk of phishing and social engineering rather than direct technical exploitation. Since the attack vector relies on user interaction and misconfiguration rather than a default behavior, the overall impact is contained, making it less severe than flaws that directly compromise application integrity or confidentiality.
Mitigation
Mitigation includes restricting images.domains and images.remotePatterns to trusted hosts only, avoiding permissive configurations, and monitoring logs for suspicious image fetches.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.3 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
