Skip to main content

Use of Cache Containing Sensitive Information in next

CVE-2025-57752

  • next
Medium
6.2/10

Summary

Next.js is a React framework for building full-stack web applications. In versions 0.9.9 through 14.2.30, 14.3.0-canary.0 through 15.4.2-canary.18, and 15.4.3 through 15.4.4, Next.js Image Optimization API routes are affected by cache key confusion. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug. All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.

  • LOW
  • LOCAL
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-524 - Use of Cache Containing Sensitive Information

The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

References

Advisory Timeline

  • Published