Skip to content
OpenAdvisories
Medium WID-SEC-2025-1934 3 CVEs

Vercel Next.js: Mehrere Schwachstellen

Published Aug 31, 2025 · Updated Oct 16, 2025 · Revision 2 · de-DE

Vendor: IBM Vendor: vercel Product: next.js Product: QRadar SIEM Platform: Windows

Summary

Ein entfernter anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um vertrauliche Informationen offenzulegen, Daten zu manipulieren und so Server-Side Request Forgery- oder Phishing-Angriffe durchzuführen.

Product

Next.js ist ein Framework für React-basierte Web-Anwendungen.

Vulnerabilities 3

  • Medium 6.5
    CVE-2025-57822 Scanner template

    Next.js Improper Middleware Redirect Handling Leads to SSRF

    Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-…

    vercel next.js jitsucom-jitsu-console next Wolfi npm
  • Medium 6.2
    CVE-2025-57752

    Next.js Affected by Cache Key Confusion for Image Optimization API Routes

    Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization API routes are affected by cache key confusion. When images returned from API routes vary based on r…

    vercel next.js jitsucom-jitsu-console next Wolfi npm
  • Medium 4.3
    CVE-2025-55173

    Next.js Content Injection Vulnerability for Image Optimization

    Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to …

    vercel next.js jitsucom-jitsu-console next Wolfi npm

Revision history

  1. #2

    Neue Updates von IBM aufgenommen

  2. #1

    Initiale Fassung

References