Server-side Request Forgery (SSRF) Affecting next package, versions >=12.0.0 <15.5.21>=16.0.0 <16.2.11

next is a react framework.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the prepareDestination rewrite/redirect handling in packages/next/src/shared/lib/router/utils/prepare-destination.ts. An attacker can make the application proxy a request to an arbitrary hostname by supplying crafted path or query values that are substituted into an external rewrites() or redirects() destination hostname. When a destination hostname is built from request-controlled input, Next.js accepts the attacker-chosen host instead of the configured suffix, causing rewrites to fetch and serve content from the attacker’s target host and redirects to send users there. This can expose internal services to SSRF or send users to unintended destinations.

Workarounds

• Do not build the hostname of an external rewrites() or redirects() destination from user-controlled input.
• If you must use a dynamic subdomain in a rewrites() rule, constrain the capture to hostname-safe characters, for example value: '(?<region>[a-z0-9-]+)'.

• GitHub Commit
• GitHub Commit
• Maintainer's Advisory