AIKIDO-2026-283297
next is vulnerable to Server-Side Request Forgery (SSRF)
83
High Risk
This Affects:
nextTL;DR
When a Server Action forwards or redirects a request, Next.js derives the outbound target from Host-associated request headers. On deployments where the incoming host header is not pinned to a trusted value, such as custom servers or setups not behind a host-pinning proxy, those headers can carry untrusted values that steer the outbound request to a malicious host. This results in Server-Side Request Forgery and, in some configurations, disclosure of internal values that weaken middleware or proxy authorization. The fix stops honoring untrusted host headers when resolving the request origin.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your deployment does not pin the incoming host header to a trusted value, such as a custom server.
Background info
next is vulnerable to Server-Side Request Forgery (SSRF) in versions 14.1.1 - 15.5.20 and 16.0.0 - 16.2.10.
How to fix this
Upgrade the next library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant