Server-side Request Forgery (SSRF) Affecting next package, versions >=14.1.1 <15.5.21>=16.0.0 <16.2.11

next is a react framework.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through createForwardedActionResponse and createRedirectRenderResult in packages/next/src/server/app-render/action-handler.ts. An attacker can make the server send a forwarded Server Action request or internal redirect to a malicious host by supplying Host-associated headers on a custom server deployment. The affected code builds the outbound origin from the incoming request’s host value when __NEXT_PRIVATE_ORIGIN is not set, so a crafted request can steer the server into contacting an attacker-controlled URL. In deployments where the host header is not pinned to a trusted origin, this can also expose internal values used in middleware or proxy authorization decisions.

Notes

• Managed hosting that pins the incoming host upstream is not in scope for this issue; the vulnerable path is the custom-server/deployment-with-untrusted-host-header case described in the advisory.
• The __NEXT_PRIVATE_ORIGIN environment variable can override the derived origin in affected versions, so deployments that set it to a fixed real origin avoid the host-header-derived outbound URL.

Workarounds

• Ensure clients cannot control the Host and X-Forwarded-Host headers your application receives by pinning or validating them at your edge or proxy, which prevents attacker-supplied host-associated headers from steering forwarded Server Actions requests or redirects to a malicious host.
• On Next.js 14.2.0 and later, set __NEXT_PRIVATE_ORIGIN to your deployment’s real origin, for example __NEXT_PRIVATE_ORIGIN=https://www.example.com node server.js, which prevents the server from deriving the outbound origin from request headers.

• GitHub Commit
• GitHub Commit
• Maintainer's Advisory