Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN571
_____________________________________________________________________

DATE                : 02/09/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running next.js (npm) versions prior to
                                    14.2.32, 15.4.7.

=====================================================================
https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v
https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v
https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f
_____________________________________________________________________

Cache Key Confusion for Image Optimization API Routes
Moderate
aaronbrown-vercel published GHSA-g5qg-72qw-gw5v Aug 29, 2025

Package
next (npm)

Affected versions
< 14.2.31, 15.0.0 - 15.4.4

Patched versions
15.4.5, 14.2.31


Description

A vulnerability in Next.js Image Optimization has been fixed in
v15.4.5 and v14.2.31. When images returned from API routes vary
based on request headers (such as Cookie or Authorization),
these responses could be incorrectly cached and served to
unauthorized users due to a cache key confusion bug.

All users are encouraged to upgrade if they use API routes to
serve images that depend on request headers and have image
optimization enabled.


More details at Vercel Changelog

Severity
Moderate
6.2/ 10

CVSS v3 base metrics
Attack vector
Local
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVE ID
CVE-2025-57752

Weaknesses
Weakness CWE-524

Credits

    @reddounsf reddounsf

_____________________________________________________________________

Content Injection for Image Optimization
Moderate
aaronbrown-vercel published GHSA-xv57-4mr9-wg8v Aug 29, 2025

Package
next.js (npm)

Affected versions
< 14.2.31, 15.0.0 - 15.4.4

Patched versions
15.4.5, 14.2.31


Description

A vulnerability in Next.js Image Optimization has been fixed in
v15.4.5 and v14.2.31. The issue allowed attacker-controlled external
image sources to trigger file downloads with arbitrary content and
filenames under specific configurations. This behavior could be abused
for phishing or malicious file delivery.

All users relying on images.domains or images.remotePatterns are
encouraged to upgrade and verify that external image sources are
strictly validated.

More details at Vercel Changelog

Severity
Moderate
4.3/ 10

CVSS v3 base metrics
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CVE ID
CVE-2025-55173

Weaknesses
No CWEs

Credits

    @kristianmagas kristianmagas Reporter

_____________________________________________________________________

Improper Middleware Redirect Handling Leads to SSRF
Moderate
aaronbrown-vercel published GHSA-4342-x723-ch2f Aug 29, 2025

Package
next.js (npm)

Affected versions
<14.2.32, <15.4.7

Patched versions
14.2.32, 15.4.7

Description

A vulnerability in Next.js Middleware has been fixed in v14.2.32 and
v15.4.7. The issue occurred when request headers were directly passed
into NextResponse.next(). In self-hosted applications, this could
allow Server-Side Request Forgery (SSRF) if certain sensitive headers
from the incoming request were reflected back into the response.

All users implementing custom middleware logic in self-hosted
environments are strongly encouraged to upgrade and verify correct
usage of the next() function.

More details at Vercel Changelog

Severity
Moderate
6.5/ 10

CVSS v3 base metrics
Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

CVE ID
CVE-2025-57822

Weaknesses
No CWEs


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================