Information disclosure vulnerability in Flags SDK (CVE-2025-46332)
An information disclosure vulnerability in Flags SDK versions 3.2.0 and earlier allowed attackers to access flag names, descriptions, options, and default values through the flags discovery endpoint. Upgrade to version 4.0.0 to remediate; Vercel has also implemented automatic network-level mitigation on their platform.
Vercel discovered and patched an information disclosure vulnerability in the , affecting versions:Flags SDK
This is being tracked as . .CVE-2025-46332We have published an automatic mitigation for the default configuration of the Flags SDK on Vercel
We recommend upgrading to (or migrating from to ) to remediate the issue. Further guidance can be found in the .flags@4.0.0@vercel/flagsflagsupgrade guide
A malicious actor could determine the following under specific conditions:
Flags providers were accessible. No write access nor additional customer data was exposed, this is limited to the values noted above. not
Vercel implemented a network-level mitigation to prevent the default flags discovery endpoint at being reachable, which automatically protects Vercel deployments against exploitation of this issue./.well-known/vercel/flags
While uncommon, if you are exposing the flags discovery endpoint through custom paths, you can also implement a custom WAF rule to restrict access to these endpoints as a mitigation, for example when using:
We recommend that all users upgrade to . Flags Explorer will be disabled and show a warning notice until you upgrade to the latest version.flags@4.0.0
More information can be found in the .upgrade guide
≤ 3.2.0
flags≤ 3.1.1
@vercel/flags
Flag names
Flag descriptions
Available options and their labels (e.g. , )
truefalseDefault flag values
Pages Router, as the original non-rewritten route would still be accessible, e.g.
/api/vercel/flagsMicrofrontends, as each application may use a distinct flags discovery endpoint
Impact and analysis
Automatic mitigation
Recommendations
Source: original entry ↗
More from Vercel
Follow Vercel to get its new changes in your feed and email digest.
OpenAI Decisions API now available on AI Gateway
OpenAI's Decisions API is now accessible through Vercel's AI Gateway with an OpenAI-compatible endpoint, enabling decision models to answer typed questions and return probabilities, choices, and scores for routing, triage, and guardrails use cases. Support is available across the OpenAI SDK, AI SDK, HTTP API, and CLI with the latest versions.
Timestamp attributes now supported in Vercel Flags
Vercel Flags now supports timestamp attributes for entities, allowing you to create time-based targeting rules. Use this feature to run limited-time campaigns, show content between specific dates, or target users based on registration date.
Glyph Cluster now available in stealth on AI Gateway
Glyph Cluster, a reasoning model for coding and long-context analysis, is now available as a stealth model on Vercel's AI Gateway for Pro and Enterprise plan teams with purchased AI Gateway credits at no cost during the stealth period. The model supports function calling, streams responses, and can be accessed via AI SDK, OpenAI-compatible APIs, and coding agents.