CVE-2025-57752: Vercel Next.js Auth Bypass Vulnerability

CVE-2025-57752 Overview

CVE-2025-57752 affects Next.js, a React framework for building full-stack web applications developed by Vercel. The vulnerability exists in the Image Optimization API and stems from cache key confusion when images returned from API routes vary based on request headers such as Cookie or Authorization. Cached image responses generated for one user can be served to unauthorized users because the caching layer does not incorporate header-based variance into the cache key. The flaw impacts Next.js versions prior to 14.2.31 and versions 15.0.0 through 15.4.4. Vercel patched the issue in Next.js 14.2.31 and 15.4.5.

Critical Impact
Unauthorized users may receive cached image responses containing sensitive content intended for authenticated sessions, resulting in confidentiality loss across tenants or user boundaries.

Affected Products

Vercel Next.js versions prior to 14.2.31
Vercel Next.js versions 15.0.0 through 15.4.4
Applications using Image Optimization with API routes that vary responses by request headers

Discovery Timeline

2025-08-29 - CVE CVE-2025-57752 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57752

Vulnerability Analysis

The vulnerability is a cache key confusion issue [CWE-524] in the Next.js Image Optimization pipeline. When a developer configures an API route as an image source and returns different image bytes depending on request headers, the optimizer caches the transformed image without factoring those headers into the cache key. A subsequent request for the same underlying URL retrieves the cached response regardless of the requester's identity or session. This design enables cross-user data exposure when the origin image content is header-dependent.

Exploitation is local in scope per the CVSS vector and does not require authentication or user interaction. An unauthenticated requester can retrieve cached image data derived from a privileged session. The impact is limited to confidentiality; integrity and availability are not affected.

Root Cause

The root cause resides in packages/next/src/server/image-optimizer.ts. The internal mock request forwarded request headers to the image source without those headers contributing to cache key derivation. As a result, header-sensitive responses were cached under a header-agnostic key, collapsing distinct authorized responses into a single shared cache entry.

Attack Vector

An attacker requests an optimized image URL that resolves to an internal API route. If a previous request from an authorized user populated the cache, the optimizer returns that cached representation to the attacker. The disclosure surface depends on what the API route emits, such as user avatars, tenant-specific graphics, or dynamically rendered charts containing sensitive data.

typescript

// Patch excerpt from packages/next/src/server/image-optimizer.ts
// Fix: remove forwarded request headers from the internal mock so cached
// responses are not derived from header-dependent upstream behavior.
    const mocked = createRequestResponseMocks({
      url: href,
      method: _req.method || 'GET',
-     headers: _req.headers,
      socket: _req.socket,
    })

Source: Next.js commit 6b12c60

Detection Methods for CVE-2025-57752

Indicators of Compromise

Image Optimization cache entries served across distinct authenticated sessions for the same underlying /_next/image URL.
API routes referenced by next/image returning content that varies on Cookie or Authorization headers.
User reports of seeing another user's avatar, chart, or tenant-branded image.

Detection Strategies

Inventory all next/image sources that point to internal API routes and identify those that read authentication headers.
Review Next.js runtime version against the fixed releases 14.2.31 and 15.4.5 in build manifests and container images.
Inspect the on-disk image cache directory for entries whose keys omit user or session discriminators.

Monitoring Recommendations

Log requests to /_next/image with associated user identifiers to identify cache hits crossing session boundaries.
Alert on responses served from the image cache when the upstream API route requires authentication.
Track Next.js version drift across services using software composition analysis in CI/CD pipelines.

How to Mitigate CVE-2025-57752

Immediate Actions Required

Upgrade Next.js to 14.2.31 for the 14.x branch or 15.4.5 for the 15.x branch.
Purge existing Image Optimization caches after upgrading to remove entries produced by the vulnerable logic.
Audit next/image usage and remove API routes as image sources where header-dependent content is returned.

Patch Information

Vercel fixed the vulnerability in Next.js 14.2.31 and 15.4.5. The fix removes forwarded request headers from the internal mock request used by the image optimizer. Details are available in the GitHub Security Advisory GHSA-g5qg-72qw-gw5v, the Next.js Pull Request #82114, and the Vercel Changelog entry for CVE-2025-57752.

Workarounds

Disable Image Optimization for API routes that return header-dependent content by serving those images directly without next/image.
Move header-dependent image generation to static or per-user URLs that embed a session or user identifier in the path or query string.
Set unoptimized: true on affected Image components until the upgrade is deployed across environments.

bash

# Upgrade Next.js to a fixed release
npm install next@14.2.31   # for the 14.x branch
# or
npm install next@15.4.5    # for the 15.x branch

# Verify the installed version
npx next --version