CyberRota Analysis
AI-GeneratedNext.js versions 14.1.1 to 15.5.20 and 16.0.0 to 16.2.10 are vulnerable to Server-Side Request Forgery (SSRF) due to improper handling of Host headers during request forwarding or redirection, potentially allowing attackers to redirect requests to malicious hosts. This vulnerability can also expose internal values that may compromise middleware or proxy authorization, particularly in custom server configurations or deployments lacking proper host header validation. Developers and organizations using affected versions, especially those with custom server setups, should prioritize upgrading to versions 15.5.21 or 16.2.11 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization. Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward. This issue has been fixed in versions 15.5.21 and 16.2.11.
Related CVEs
Other vulnerabilities affecting the same vendor(s)