Use of cache containing sensitive information in Next.js - CVE-2025-57752

Vulnerability identifier: #VU114574

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-57752

CWE-ID: CWE-524

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper cache management in Image Optimization API. A remote attacker can gain access to sensitive images cached by the application. 

Next.js
IBM Security QRadar Network Threat Analytics
QRadar Pre-Validation App
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
WatsonX BI Assistant
Maximo Application Suite - Edge Data Collector
User Entity Behavior Analytics
InfoSphere Optim Archive Viewer
IBM Cloud Pak for Security
QRadar Suite
IBM Security QRadar Analyst Workflow

Install updates from vendor's website.

Next.js - addressed in versions 14.2.31, 15.4.5
IBM Security QRadar Network Threat Analytics - update to 1.4.2
IBM Cloud Pak for Security - update to 1.11.9.0
QRadar Pre-Validation App - update to 2.0.2
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2.2
WatsonX BI Assistant - update to 5.2.2
Maximo Application Suite - Edge Data Collector - addressed in versions 8.11.21, 9.0.13, 9.1.3
QRadar Suite - update to 1.11.9.0
IBM Security QRadar Analyst Workflow - update to 3.0.1
User Entity Behavior Analytics - update to 5.0.2
InfoSphere Optim Archive Viewer - update to 11.7.0.14

• https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd
• https://github.com/vercel/next.js/pull/82114
• https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v
• https://vercel.com/changelog/cve-2025-57752

• Use of cache containing sensitive information in Next.js
• Multiple vulnerabilities in IBM User Entity Behavior Analytics
• Multiple vulnerabilities in IBM Edge Data Collector
• Multiple vulnerabilities in IBM WatsonX BI Assistant for CP4D
• Multiple vulnerabilities in IBM Security QRadar Analyst Workflow for IBM QRadar SIEM
• Multiple vulnerabilities in IBM Security QRadar Network Threat Analytics
• Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM QRadar Pre-Validation App
• Multiple vulnerabilities in IBM QRadar Suite
• Multiple vulnerabilities in IBM InfoSphere Optim Archive Viewer