# CVE-2025-55173: Next.js Content Injection Vulnerability for Image Optimization

- Exploited (CISA KEV): no
- Published: 2025-08-29
- CVSS: 4.3 MEDIUM (v3.1)
- EPSS: 0.6% (49th percentile)
- CWE: CWE-20

Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2025-08-29 | 0 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-08-29 · new · rule ea55f8aac44246cc9b827eea9ff4bfe3 · default Block
  > Next.js - Dangerous File Download - CVE:CVE-2025-55173. Previous action: N/A. New action: Block. This is a new detection
  Source: https://developers.cloudflare.com/changelog/post/2025-08-29-emergency-waf-release/

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2025-55173 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2025-55173