--- title: "Security | Netlify Changelog" description: "Stay updated with the latest features, fixes, and improvements. Realize the speed, agility and performance of a scalable, composable web architecture with Netlify. Explore the composable web platform now!" source: "https://www.netlify.com/changelog/tag/security/page/3/" last_updated: "2026-08-29T21:12:06.000Z" --- # Posts tagged "Security" All Tags Agent-runners AI Ai-gateway Angular Astro AX Build CLI Database Design Devtools Domains E-commerce Extensions Forms Framework Functions Logs Next.js Nuxt.js Remix SDK Security Updates Workflow [Subscribe to feed](https://www.netlify.com/changelog/tag/security/feed.xml) - [ ## Security Update: Multiple vulnerabilities in Next.js ](/changelog/security-update-multiple-vulnerabilities-in-next-js-2025-08/) August 30, 2025 - [security](/changelog/tag/security/) - [next.js](/changelog/tag/next-js/) We are aware of recently disclosed vulnerabilities affecting Next.js applications: 1. [CVE-2025-55173](https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v): **Next.js Image Optimization – Arbitrary File Download** 2. [CVE-2025-57822](https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f): **Next.js Middleware – SSRF via Misuse of `next()`** 3. [CVE-2025-57752](https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v): **Next.js Image Optimization – Cache Poisoning / Unauthorized Disclosure** As a security precaution, we recommend upgrading to the latest versions of Next.js and enabling [**automatic updates of the OpenNext Netlify Next.js adapter**](https://docs.netlify.com/frameworks/next-js/overview/#reverting-to-an-older-adapter-version). The engineering team at Netlify has reviewed these and determined the following impact on Netlify sites: \* 1. [CVE-2025-55173](https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v): **Next.js Image Optimization – Arbitrary File Download** Sites on Netlify **are not vulnerable**. Next.js sites on Netlify use Netlify’s Image CDN instead of the affected built-in Next.js Image Optimization feature. Furthermore, Netlify Image CDN strips `Content-Disposition` headers, which is required for successful exploitation of this vulnerability. With this header removed it is not possible to force a file download or override the filename, even in case of a mismatch between the requested image type and the source file type. 2. [CVE-2025-57822](https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f): **Next.js Middleware – SSRF via Misuse of `next()`** Sites on Netlify **are not vulnerable**. Our OpenNext adapter uses Edge Functions to run middleware and relies on the `context.next()` API as the underlying implementation of `NextResponse.next()` calls, passing the original request URL and preventing this attack vector. 3. [CVE-2025-57752](https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v): **Next.js Image Optimization – Cache Poisoning / Unauthorized Disclosure** Next.js sites on Netlify are **potentially vulnerable**, if the sites use the `next/image` component to fetch images from a source that uses headers to conditionally serve images. Next.js sites using the `next/image` component will automatically opt into Netlify’s Image CDN which, by design, will automatically cache the source assets on Netlify’s Edge Cache. This means that a source image that is served behind an authorization header will get cached on the Netlify Edge Cache in order to improve performance. Upgrading to the newest version of Next.js will not change this behavior. If your Next.js site serves images from a protected source, we advise you to not use the `next/image` component so that you have full control over the caching and authorization strategies required for your use-case. We are working continually with the Next.js team and are committed to making your sites secure on Netlify. [Permalink to Security Update: Multiple vulnerabilities in Next.js Permalink](/changelog/security-update-multiple-vulnerabilities-in-next-js-2025-08/) - [ ## Security Update: Next.js sites on Netlify not vulnerable to CVE-2025-32421 ](/changelog/security-update-next-js-sites-on-netlify-not-vulnerable-to-cve-2025-32421/) May 15, 2025 - [security](/changelog/tag/security/) - [next.js](/changelog/tag/next-js/) The Next.js team [recently disclosed CVE-2025-32421](https://github.com/vercel/next.js/security/advisories/GHSA-qpjv-v59x-3qc4), a low-severity vulnerability allowing for CDN cache poisoning in some scenarios. The engineering team at Netlify has confirmed that all Next.js sites on Netlify **are not vulnerable**. The vulnerability requires use of a CDN that may cache responses without explicit Cache-Control headers, but Netlify’s CDN never does so. As a general security precaution, we recommend upgrading to the latest versions of the Next.js framework and [allowing automatic updates of the OpenNext Netlify Next.js adapter](https://docs.netlify.com/frameworks/next-js/overview/#reverting-to-an-older-adapter-version). [Permalink to Security Update: Next.js sites on Netlify not vulnerable to CVE-2025-32421 Permalink](/changelog/security-update-next-js-sites-on-netlify-not-vulnerable-to-cve-2025-32421/) - [ ## Security Update: React Router and Remix Vulnerabilities ](/changelog/security-update-react-router-remix-vulnerabilities/) April 27, 2025 - [security](/changelog/tag/security/) - [remix](/changelog/tag/remix/) We are aware of recently disclosed vulnerabilities affecting React Router and Remix: 1. **[CVE 2025-31137](https://github.com/remix-run/react-router/security/advisories/GHSA-4q56-crqp-v477) (React Router 7 and Remix): Spoof request path allowing certain access control bypasses** 2. **[CVE-2025-43864](https://github.com/advisories/GHSA-f46r-rw29-r322) (React Router 7 only): Cache poisoning leading to unusable responses** 3. **[CVE-2025-43865](https://github.com/remix-run/react-router/security/advisories/GHSA-cpj6-fhp6-mr6j) (React Router 7 only): Cache poisoning with arbitrary data** **Impact on Netlify sites:** - **CVE 2025-31137:** Sites on Netlify **are not vulnerable**, because the Netlify CDN cache varies on the query string by default, and Remix and React Router sites on Netlify do not use the impacted Express package. - **CVE-2025-43864:** Sites on Netlify using **React Router 7.2.0 to 7.5.1** **were vulnerable until 04/27 3:00 UTC**. However, exploitation requires _all_ of the following conditions for a given URL to be poisonable: - The site must not be using React Router’s SPA mode. - The page or loader must be explicitly setting **caching headers**. - A malicious request would need to be the **first request** to reach the cache (such as immediately after a deploy or cache invalidation). - **CVE-2025-43865:** Sites on Netlify using **React Router 7.0.0 to 7.5.1** **were vulnerable until 04/27 3:00 UTC**. However, exploitation requires _all_ of the following conditions for a given URL to be poisonable: - The page or loader must be explicitly setting **caching headers**. - A malicious request would need to be the **first request** to reach the cache (such as immediately after a deploy or cache invalidation). We strongly recommend upgrading to the latest versions of React Router (7.5.2). Given these specific requirements, the number of vulnerable Netlify sites is low. However, out of an abundance of caution, our engineering team is actively rolling out a mitigation to further protect against these vulnerabilities. We will continue to monitor the situation and will provide updates as our work progresses. **Update:** As of 2025-04-27 3:00 AM UTC, a mitigation has been rolled out to the Netlify CDN for all vulnerable sites. [Permalink to Security Update: React Router and Remix Vulnerabilities Permalink](/changelog/security-update-react-router-remix-vulnerabilities/) [Previous page](/changelog/tag/security/page/2)