# CVE-2025-57752: Next.js Affected by Cache Key Confusion for Image Optimization API Routes

- Exploited (CISA KEV): no
- Published: 2025-08-29
- CVSS: 6.2 MEDIUM (v3.1)
- EPSS: 0.3% (28th percentile)
- CWE: CWE-524

Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization API routes are affected by cache key confusion. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5. All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2025-08-29 | 0 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-08-29 · new · rule e2b2d77a79cc4a76bf7ba53d69b9ea7d · default Block
  > Next.js - Information Disclosure - CVE:CVE-2025-57752. Previous action: N/A. New action: Block. This is a new detection
  Source: https://developers.cloudflare.com/changelog/post/2025-08-29-emergency-waf-release/

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2025-57752 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2025-57752