# CVE\-2025\-57752

**Published:** August 29, 2025 | **Authors:** Aaron Brown, Steven Salat, Zack Tanner

---

## Summary

A vulnerability affecting **Next.js Image Optimization** has been addressed. It impacted versions prior to **v15.4.5** and **v14.2.31**, and involved a cache poisoning issue that caused sensitive image responses from API routes to be cached and subsequently served to unauthorized users.

Vercel deployments were never impacted by this vulnerability.

## Impact

When API routes are used to return image content that varies based on headers (e.g., `Cookie`, `Authorization`), and those images are passed through Next.js Image Optimization, the optimized image may be cached without including those request headers as part of the cache key. This can lead to:

- **Unauthorized disclosure** of user-specific or protected image content
- **Cross-user leakage** of conditional content via CDN or internal cache

This issue arises without user interaction and requires no elevated privileges, only a prior authorized request to populate the cache.

## Resolution

The issue was resolved by ensuring request headers aren’t forwarded to the request that is proxied to the image endpoint. This ensures that the image endpoint cannot be used to serve images that require authorization data and thus cannot be cached.

Fix available in:

- **Next.js v15.4.5**
- **Next.js v14.2.31**

## Credit

Thanks to [reddounsf](https://github.com/reddounsf) for the responsible disclosure.

## References

- [GitHub Advisory: GHSA-g5qg-72qw-gw5v](https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v)
- [Fix PR #82114](https://github.com/vercel/next.js/pull/82114)
- [Next.js Release Notes](https://github.com/vercel/next.js/releases)

---

📚 **More updates:** [View all changelog entries](/changelog/sitemap.md) | [Blog](/blog/sitemap.md)