Next.js, a React framework for full-stack web applications, has an SSRF vulnerability (CWE-918) in versions >=14.1.1 <15.5.21 and >=16.0.0 <16.2.11. The flaw arises when Server Actions forward or redirect requests and the attacker can manipulate Host-associated headers, causing the server to send outbound requests to attacker-controlled hosts. This can also expose internal values weakening middleware or proxy authorization in some configurations. The vulnerability requires that the incoming host header is not fixed to a trusted value, which is common in custom servers or deployments without upstream host pinning. Managed hosting environments and next start/standalone output from version 14.2 onward mitigate this risk by pinning the host upstream. The vulnerability has been addressed in versions 15.5.21 and 16.2.11.

An attacker able to control Host headers in affected Next.js versions can exploit SSRF to make the server send requests to arbitrary malicious hosts. This may lead to unauthorized internal resource access or bypass of middleware/proxy authorization in some setups. The vulnerability does not require privileges or user interaction but depends on the server configuration regarding host header validation.

Upgrade Next.js to version 15.5.21 or later in the 15.x branch, or 16.2.11 or later in the 16.x branch, where this SSRF vulnerability is fixed. For deployments using custom servers or without upstream host pinning, ensure that the incoming host header is validated and fixed to a trusted value. Managed hosting environments and next start/standalone output from version 14.2 onward already mitigate this issue by pinning the host upstream.