CVE-2025-46332: Information Disclosure via Flags override link
First published: Fri May 02 2025(Updated: )
## Summary An information disclosure vulnerability affecting Flags SDK has been addressed. It impacted `flags` ≤3.2.0 and `@vercel/flags` ≤3.1.1 and in certain circumstances, allowed a bad actor with detailed knowledge of the vulnerability to list all flags returned by the flags discovery endpoint (`.well-known/vercel/flags`). ## Impact This vulnerability allowed for information disclosure, where a bad actor could gain access to a list of all feature flags exposed through the flags discovery endpoint, including the: - Flag names - Flag descriptions - Available options and their labels (e.g. `true`, `false`) - Default flag values Not impacted: - Flags providers were not accessible No write access nor additional customer data was exposed, this is limited to just the values noted above. Vercel has automatically mitigated this incident on behalf of our customers for the default flags discovery endpoint at `.well-known/vercel/flags`. Flags Explorer will be disabled and show a warning notice until upgraded to `flags@4.0.0`. ## Resolution The `verifyAccess` function was patched within `flags@4.0.0`. Users of `@vercel/flags` should also migrate to `flags@4.0.0`. For further guidance on upgrading your version, please see our [upgrade guide](https://github.com/vercel/flags/blob/main/packages/flags/guides/upgrade-to-v4.md). ## Mitigations Vercel implemented a network-level mitigation to prevent the default flags discovery endpoint at `/.well-known/vercel/flags` being reachable, which automatically protects Vercel deployments against exploitation of this issue. Users need to upgrade to `flags@4.0.0` to re-enable the Flags Explorer. This automatic mitigation is not effective in two scenarios: - When using the Flags SDK on Pages Router, as the original non-rewritten route would still be accessible, e.g. `/api/vercel/flags`. - When using a custom path for the flags discovery endpoint. If you are not protected by the Vercel default mitigation you can temporarily deny access to the other exposed flags discovery endpoints through a custom WAF rule while you upgrade to the latest version. ## References - https://vercel.com/changelog/information-disclosure-in-flags-sdk-cve-2025-46332 - https://github.com/vercel/flags/blob/main/packages/flags/guides/upgrade-to-v4.md
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Flags Flags SDK | >=3.2.0 | |
| Vercel @vercel/flags | >=3.1.1 | |
| npm/@vercel/flags | <=3.1.1 | |
| npm/flags | <=3.2.0 | 4.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/vercel/flags/security/advisories/GHSA-892p-pqrr-hxqr
- https://github.com/vercel/flags/blob/main/packages/flags/guides/upgrade-to-v4.md
- https://vercel.com/changelog/information-disclosure-in-flags-sdk-cve-2025-46332
- https://nvd.nist.gov/vuln/detail/CVE-2025-46332
- https://github.com/advisories/GHSA-892p-pqrr-hxqr (Advisory)
Frequently Asked Questions
What is the severity of CVE-2025-46332?
CVE-2025-46332 is considered a high severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2025-46332?
To fix CVE-2025-46332, upgrade to Flags SDK version 3.2.1 or later and @vercel/flags version 3.1.2 or later.
What types of applications are affected by CVE-2025-46332?
CVE-2025-46332 affects applications using Flags SDK versions 3.2.0 and below and @vercel/flags versions 3.1.1 and below.
What impact does CVE-2025-46332 have on application security?
CVE-2025-46332 allows unauthorized access to sensitive feature flags, potentially leading to unauthorized features being activated.
Is there a workaround for CVE-2025-46332 if I cannot immediately upgrade?
There is no known workaround for CVE-2025-46332; upgrading to patched versions is required to mitigate the risk.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-892p-pqrr-hxqr
- alias/CVE-2025-46332
- agent/references
- agent/last-modified-date
- agent/softwarecombine
- agent/description
- agent/event
- collector/nvd-cve
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/flags
- canonical/flags flags sdk
- vendor/vercel
- canonical/vercel @vercel/flags
- package-manager/npm