Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦 npm

GHSA-fr5h-rqp8-mj6g

HIGH

Next.js Server-Side Request Forgery in Server Actions

Also known asCVE-2024-34351
Published
May 9, 2024
Updated
Feb 4, 2026
Affected
1 pkg
Patched
1 / 1
Exploits
4 known

EPSS Exploitation Probability

via FIRST.org ↗
92.8%probability of exploitation in next 30 days
Very High Risk100th percentile0.00%
91.1%91.8%92.5%93.3%91.6%92.8%Dec 25Apr 26Jun 26

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Blast Radius

1 pkg affected

Weekly download volume for affected packages — a proxy for how broadly this vulnerability is deployed.

nextnpm
37.4Mdownloads / week

Description

Impact

A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions by security researchers at Assetnote. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself.

Prerequisites

  • Next.js (<14.1.1) is running in a self-hosted* manner.
  • The Next.js application makes use of Server Actions.
  • The Server Action performs a redirect to a relative path which starts with a /.

* Many hosting providers (including Vercel) route requests based on the Host header, so we do not believe that this vulnerability affects any Next.js applications where routing is done in this manner.

Patches

This vulnerability was patched in #62561 and fixed in Next.js 14.1.1.

Workarounds

There are no official workarounds for this vulnerability. We recommend upgrading to Next.js 14.1.1.

Credit

Vercel and the Next.js team thank Assetnote for responsibly disclosing this issue to us, and for working with us to verify the fix. Thanks to:

Adam Kues - Assetnote Shubham Shah - Assetnote

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npmnext≥ 13.4.0&&< 14.1.114.1.1
Exploits & PoCs
4

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

Next.js is a React framework that can provide building blocks to create …

github.comGithubMay 2024

Next.js is a React framework that can provide building blocks to create …

github.comGithubAug 2024

Frequently Asked Questions

### Impact A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions by security researchers at Assetnote. If the `Host` header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. #### Prerequisites * Next.js (`<14.1.1`) is running in a self-hosted* manner. * The Next.js application makes use of Server Actions. * The Server Action performs a redirect to a relative path which starts with a `/`. \* Many hosting providers (including Vercel) route r
O3 Security · Impact-Aware SCA

Is GHSA-fr5h-rqp8-mj6g in your stack?

O3 detects GHSA-fr5h-rqp8-mj6g across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my stack How O3 SCA works