CVE-2025-55173

What it actually does

A vulnerability in the Next.js Image Optimization feature allows an attacker-controlled external image source to dictate the `Content-Disposition` header of the response. When a Next.js application, configured with `images.domains` or `images.remotePatterns`, processes a URL for an image hosted on a malicious server, it can be tricked into serving a response that instructs the user's browser to download a file with an arbitrary filename and content, rather than rendering an image.

Why it matters to the business

This vulnerability allows attackers to abuse a trusted website to deliver malicious files to its users. This can lead to successful phishing campaigns, malware or ransomware infections, and significant damage to the website's reputation and user trust. Users are more likely to trust and open a file that appears to be downloaded from a legitimate site, increasing the likelihood of a successful attack.

How an attack unfolds

An attacker first identifies a Next.js application that uses the Image Optimization feature and allows images from an attacker-controlled domain. The attacker then sets up a server at that domain to respond to requests with a malicious payload and a `Content-Disposition: attachment; filename="payload.exe"` header. They craft a URL using the `/_next/image` endpoint that points to their malicious server and trick a user into clicking it. The user's browser requests the 'image' from the Next.js application, which in turn fetches it from the attacker's server. The Next.js server forwards the malicious response, including the `Content-Disposition` header, to the user. The user's browser then initiates a file download for `payload.exe`, which the user may run, believing it comes from the trusted website.

How to fix it

To remediate this vulnerability, upgrade the Next.js dependency to a patched version. The issue is fixed in versions **v15.4.5** and **v14.2.31** and later. After updating your `package.json`, run `npm install` or `yarn install` to apply the changes and redeploy your application. As a security best practice, also review your `next.config.js` file and ensure that `images.domains` and `images.remotePatterns` are strictly limited to fully trusted domains.

How to confirm the fix worked

To validate the fix, inspect your project's `package-lock.json` or `yarn.lock` file to confirm that the resolved version of `next` is `15.4.5`, `14.2.31`, or a newer version. To check for exposure, audit the `images.domains` and `images.remotePatterns` configurations in your `next.config.js` file. Remove any untrusted or overly permissive entries. In a test environment, you can attempt to reproduce the vulnerability by adding a test domain, serving a file with a `Content-Disposition: attachment` header, and verifying that the patched Next.js version no longer triggers a file download in the browser.

Typical attack path

1. Attacker identifies a target Next.js application using external image optimization.
2. Attacker confirms their malicious domain is whitelisted in the application's `images.domains` or `images.remotePatterns` configuration.
3. Attacker configures their server to respond to requests with a malicious file and a `Content-Disposition: attachment` header.
4. Attacker crafts a URL pointing to the Next.js `/_next/image` endpoint, which references the malicious server.
5. Attacker distributes the URL to victims via phishing or by posting it on a public forum.
6. A victim clicks the link, causing their browser to request the resource from the target Next.js application.
7. The Next.js application proxies the request to the attacker's server and forwards the malicious response back to the victim.
8. The victim's browser receives the response and prompts the user to download the malicious file.

How to detect it

To detect potential exploitation, monitor web server and reverse proxy logs for HTTP requests to the `/_next/image` endpoint. A successful exploit would result in the server sending a response to the client containing a `Content-Disposition: attachment` header. Correlate requests to `/_next/image` with their corresponding HTTP responses. Look for responses where the `Content-Type` is not a standard image format (e.g., `image/jpeg`, `image/png`) or where the `Content-Disposition` header is present, as this indicates a file download was triggered instead of an image being displayed.

• Content-Disposition: attachment; filename=

What your security team should do

• Immediately upgrade all Next.js applications to a patched version (v15.4.5+ or v14.2.31+).
• Audit all `next.config.js` files to review and restrict the configured `images.domains` and `images.remotePatterns` to only essential, trusted sources.
• Prioritize patching and auditing applications that use permissive remote image patterns, as they are the most exposed.
• Analyze web server logs for historical requests to the `/_next/image` endpoint that may have resulted in non-image content types or `Content-Disposition: attachment` headers being served.