What is CVE-2024-34351?

CVE-2024-34351 is a high-severity vulnerability in Vercel Next.js, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.5/10. Published 2024-05-09.

How severe is CVE-2024-34351?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2024-34351 known to be exploited?

19 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SSRF in Vercel Next.js

CVE-2024-34351

Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditio…

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.928 (99.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Vercel Next.js — versions >= 13.4.0, < 14.1.1

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

Public proof-of-concept exploits

References

https://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g (x_refsource_CONFIRM)
https://github.com/vercel/next.js/pull/62561 (x_refsource_MISC)
https://github.com/vercel/next.js/commit/8f7a6ca7d21a97bc9f7a1bbe10427b5ad74b9085 (x_refsource_MISC)

Frequently asked questions

What is CVE-2024-34351?: CVE-2024-34351 is a high-severity vulnerability in Vercel Next.js, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.5/10. Published 2024-05-09.
How severe is CVE-2024-34351?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2024-34351 known to be exploited?: 19 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.