CVE-2024-34351
Description
Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. The required conditions are 1) Next.js is running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server Action performs a redirect to a relative path which starts with a /. This vulnerability was fixed in Next.js 14.1.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
nextnpm | >= 13.4.0, < 14.1.1 | 14.1.1 |
Affected products
9- osv-coords7 versionspkg:apk/chainguard/jitsucom-jitsupkg:apk/chainguard/jitsucom-jitsu-consolepkg:apk/chainguard/jitsucom-jitsu-rotorpkg:apk/wolfi/jitsucom-jitsupkg:apk/wolfi/jitsucom-jitsu-consolepkg:apk/wolfi/jitsucom-jitsu-rotorpkg:npm/next
< 2.8.0-r0+ 6 more
- (no CPE)range: < 2.8.0-r0
- (no CPE)range: < 2.8.0-r0
- (no CPE)range: < 2.8.0-r0
- (no CPE)range: < 2.8.0-r0
- (no CPE)range: < 2.8.0-r0
- (no CPE)range: < 2.8.0-r0
- (no CPE)range: >= 13.4.0, < 14.1.1
Patches
Vulnerability mechanics
References
5- github.com/vercel/next.js/commit/8f7a6ca7d21a97bc9f7a1bbe10427b5ad74b9085nvdPatchWEB
- github.com/vercel/next.js/pull/62561nvdIssue TrackingPatchWEB
- github.com/advisories/GHSA-fr5h-rqp8-mj6gghsaADVISORY
- github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6gnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2024-34351ghsaADVISORY
News mentions
0No linked articles in our index yet.