CVE-2024-34351highCWE-918

CVE-2024-34351: high-severity vulnerability in vercel next.js

Next.js Server-Side Request Forgery in Server Actions

Published · Updated

Follow this CVE+ Monitor next.js+ Monitor next

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

36Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 7.5epss 5.5%
In short

A flaw in Next.js Server Actions allows attackers to trick the server into making requests by manipulating the Host header and triggering redirects, making it appear the server itself is the requester. This matters because it can expose internal services or resources that should only be accessible from within the network.

Technical detail

SSRF vulnerability in Next.js Server Actions triggered via Host header manipulation combined with relative path redirects (starting with /). Requires self-hosted Next.js deployment using Server Actions that perform redirects; attacker can forge requests appearing to originate from the application server, potentially accessing internal endpoints or exfiltrating sensitive data. Fixed in Next.js 14.1.1.

Summary generated and translated by AI from the official description.
Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. The required conditions are 1) Next.js is running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server Action performs a redirect to a relative path which starts with a `/`. This vulnerability was fixed in Next.js `14.1.1`.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
vercel · next.js
Related CVEs — vercel next.js

In the same product, most dangerous first.

CVE-2025-29927CRITICALAuthorization Bypass in Next.js MiddlewareEPSS 99.2%CVE-2024-46982HIGHCache Poisoning in next.jsEPSS 59.2%CVE-2021-43803HIGHUnexpected server crash in Next.jsEPSS 47.3%CVE-2026-44578HIGHNext.js: Server-side request forgery in applications using WebSocket upgradesEPSS 35.5%CVE-2024-51479HIGHAuthorization bypass in Next.jsEPSS 4.0%CVE-2025-57822MEDIUMNext.js Improper Middleware Redirect Handling Leads to SSRFEPSS 2.6%