Next.js Server-Side Request Forgery in Server Actions

The SSRF vulnerability in Next.js Server Actions allows an attacker to craft malicious requests that appear to originate from the Next.js application server. This can be exploited to access internal resources that are otherwise protected, such as internal APIs, databases, or cloud services. Specifically, the vulnerability is triggered when a Server Action performs a redirect to a relative path starting with a /. By manipulating the Host header, an attacker can bypass security controls and make requests to arbitrary internal or external URLs. The potential blast radius depends on the internal services accessible from the Next.js server; access to sensitive data or the ability to trigger actions on internal systems are possible outcomes. This vulnerability shares similarities with other SSRF exploits where attackers leverage the server's trust to access restricted resources.

1. आरक्षित2024-05-02
2. प्रकाशित2024-05-09
3. संशोधित2026-02-04
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-34351 is to upgrade to Next.js version 14.1.1 or later, which includes the fix for this vulnerability. If upgrading immediately is not feasible, consider implementing temporary workarounds. Carefully review and validate all user-supplied input used in Server Actions, particularly the Host header. Implement strict input validation and sanitization to prevent attackers from manipulating the header. Consider using a Web Application Firewall (WAF) or reverse proxy to filter out malicious requests and restrict outbound connections from the Next.js application. Additionally, review the application's configuration to ensure that Server Actions are not configured to perform redirects to untrusted relative paths. After upgrading, confirm the fix by attempting to trigger the vulnerable Server Action with a modified Host header and verifying that the request is rejected.