Packages / next / Security

HighVulnerabilityGHSA-fr5h-rqp8-mj6gCVE-2024-34351Published 9 May 2024

Next.js Server-Side Request Forgery in Server Actions

Affected releases · next

  • 14.x14.0.0 – 14.1.0Fixed in 14.1.1
  • 13.x13.4.0 – 13.5.11No fix on this line yet

On 14.x, the newest line:

npm install next@14.1.1
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

14.x

  1. Affected

    14.0.0 – 14.1.0

    6 releases

  2. Fixed

    14.1.1 – 14.2.35

    40 releases

13.x

  1. Not affected

    13.0.0 – 13.3.4

    25 releases

  2. Affected

    13.4.0 – 13.5.11

    31 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Impact

A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions by security researchers at Assetnote. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself.

Prerequisites

  • Next.js (<14.1.1) is running in a self-hosted* manner.

  • The Next.js application makes use of Server Actions.

  • The Server Action performs a redirect to a relative path which starts with a /.

* Many hosting providers (including Vercel) route requests based on the Host header, so we do not believe that this vulnerability affects any Next.js applications where routing is done in this manner.

Patches

This vulnerability was patched in #62561 and fixed in Next.js 14.1.1.

Workarounds

There are no official workarounds for this vulnerability. We recommend upgrading to Next.js 14.1.1.

Credit

Vercel and the Next.js team thank Assetnote for responsibly disclosing this issue to us, and for working with us to verify the fix. Thanks to:

Adam Kues - Assetnote Shubham Shah - Assetnote