CVE-2024-34351 Next.js Server-Side Request Forgery in Server Actions
Attackers can exploit SSRF in Next.js Server Actions by modifying the Host header, allowing requests from the server if specific redirect conditions are met.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-34351?
CVE-2024-34351 is a high-severity server-side request forgery vulnerability in Vercel Next.js, published on 9 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. The required conditions are 1) Next.js is running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server Action performs a redirect to a relative path which starts with a `/`. This vulnerability was fixed in Next.js `14.1.1`.
Weakness: CWE-918
Which versions are affected by CVE-2024-34351?
2 open source packages ship an affected version, including next. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
next npm | From 13.4.0 | 14.1.1 |
next npm | From 13.4.0 | 14.1.1 |
Products include Vercel Next.js.
How do I fix CVE-2024-34351?
Upgrade next to 14.1.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-34351 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-34351 exists.
Public exploit code: 1 Nuclei template and 4 proofs of concept on GitHub.
Other vulnerabilities in Vercel Next.js
- CVE-2025-29927 Authorization Bypass in Next.js Middleware
- CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgrades
- CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
- CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Sources
Also known as GHSA-fr5h-rqp8-mj6g, MINI-fjrc-v88x-336m, ROOT-APP-NPM-CVE-2024-34351.