CVE-2025-57752: 
ASP.NET Core vulnerability analysis and mitigation

CVE-2025-57752 is a cache key confusion vulnerability in Next.js Image Optimization that can cause sensitive images to be incorrectly cached and served to unauthorized users. It affects Next.js versions >= 0.9.9 and < 14.2.31, as well as versions >= 15.0.0 and <= 15.4.4. The vulnerability was disclosed on August 29, 2025, by Vercel, with patches released in versions 14.2.31 and 15.4.5. It carries a CVSS v3.1 base score of 6.2 (Medium) (GitHub Advisory, Vercel Changelog).

The root cause is classified as CWE-524 (Use of Cache Containing Sensitive Information). In Next.js's image optimizer (image-optimizer.ts), when processing requests for "internal" images served via API routes, the incoming request headers (such as Cookie or Authorization) were forwarded to the internal serverless function handler, but these headers were not included in the cache key. As a result, an authenticated user's image response could be cached and subsequently served to an unauthenticated or differently-authenticated user who requests the same image URL. The fix, implemented in commit 6b12c60, removes header forwarding for internal images entirely, making the behavior consistent with external images (neither receives headers), and adds a regression test using a cookie-conditional API route (GitHub Commit, GitHub Advisory).

Successful exploitation results in unauthorized disclosure of images that were intended to be access-controlled. An attacker could access cached images meant only for authenticated users — such as profile pictures, private documents rendered as images, or other sensitive visual content — without providing valid authentication credentials. There is no integrity or availability impact; the vulnerability is limited to confidentiality loss (GitHub Advisory, Vercel Changelog).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.012–0.144%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires that the target application uses API routes to serve images that vary based on request headers (e.g., Cookie or Authorization) and has image optimization enabled — a specific but not uncommon configuration (GitHub Advisory, Feedly).

1. Identify a vulnerable target: Locate a Next.js application running a version < 14.2.31 or between 15.0.0 and 15.4.4 that uses the built-in image optimization feature (/_next/image endpoint).
2. Find an auth-gated image API route: Identify an API route (e.g., /api/user-avatar) that returns different image content based on request headers such as Cookie or Authorization.
3. Trigger cache population by an authenticated user: As an authenticated user (or by observing/timing a legitimate user's request), send a request to /_next/image?url=/api/user-avatar&w=<width>&q=<quality> with valid authentication headers. This causes the image optimizer to fetch and cache the response.
4. Access the cached image without authentication: As an unauthenticated user, send the same /_next/image request (same URL, width, and quality parameters) without any authentication headers. Because the cache key does not include the request headers, the previously cached authenticated response is returned.
5. Retrieve sensitive image content: The unauthenticated attacker receives the image that was intended only for the authenticated user (GitHub Advisory, GitHub Commit).

• Network: Repeated requests to /_next/image with the same url, w, and q parameters from different source IPs or sessions, particularly where some requests lack authentication cookies or authorization headers that earlier requests included.
• Logs: Next.js server access logs showing /_next/image requests returning HTTP 200 responses to unauthenticated sessions for image URLs that should require authentication; absence of Cookie or Authorization headers in requests that receive authenticated image content.
• Application Behavior: Users reporting seeing images belonging to other users, or API routes returning 401/403 when called directly but images being accessible via the /_next/image optimization endpoint without credentials.

Upgrade Next.js to version 14.2.31 (for the v14 branch) or 15.4.5 (for the v15 branch) or later, as these releases contain the fix that removes header forwarding from the image optimizer's internal fetch (GitHub Advisory, Vercel Changelog). As a temporary workaround if upgrading is not immediately possible, avoid serving authentication-dependent images through API routes that pass through Next.js image optimization, or disable image optimization for those routes. IBM has also issued a security bulletin for IBM InfoSphere Optim Archive Viewer, which is affected by this vulnerability and requires a corresponding update (IBM Advisory).

Vercel published a dedicated changelog entry for CVE-2025-57752 on the day of disclosure (August 29, 2025), providing clear remediation guidance (Vercel Changelog). Cloudflare released an emergency WAF rule update on the same day to provide additional protection for users (Cloudflare Changelog). Community discussion appeared on the Vercel subreddit shortly after disclosure, and the vulnerability was picked up by standard security aggregators and vulnerability databases within hours of publication.