{"cve":"CVE-2024-34351","nvd":{"published":"2024-05-14T15:38:42.563","modified":"2026-06-17T07:33:13.680","status":"Analyzed","description":"Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. The required conditions are 1) Next.js is running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server Action performs a redirect to a relative path which starts with a `/`. This vulnerability was fixed in Next.js `14.1.1`.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5},"cwes":["CWE-918"],"references":["https://github.com/vercel/next.js/commit/8f7a6ca7d21a97bc9f7a1bbe10427b5ad74b9085","https://github.com/vercel/next.js/pull/62561","https://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g","https://github.com/vercel/next.js/commit/8f7a6ca7d21a97bc9f7a1bbe10427b5ad74b9085","https://github.com/vercel/next.js/pull/62561"],"products":["vercel:next.js"],"source":"nvd","synced_at":"2026-10-19T21:49:23.840078609+00:00"},"epss":{"cve":"CVE-2024-34351","score":0.05453,"percentile":0.92738,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-fr5h-rqp8-mj6g","url":"https://osv.dev/vulnerability/GHSA-fr5h-rqp8-mj6g","summary":"Next.js Server-Side Request Forgery in Server Actions","modified":"2026-09-10T03:50:00.353665045Z","packages":[{"ecosystem":"npm","name":"next","purl":"pkg:npm/next","ranges":[">=13.4.0 <14.1.1"],"fixed":["14.1.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}