# CVE-2024-34351: Next.js - SSRF

> Live exploitation tracking for CVE-2024-34351 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-34351

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** Vercel Next.js
- **Weaknesses:** CWE-918 (Server-Side Request Forgery (SSRF))
- **Tags:** web_application, javascript, nodejs

## Description

Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. The required conditions are 1) Next.js is running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server Action performs a redirect to a relative path which starts with a `/`. This vulnerability was fixed in Next.js `14.1.1`.

## CrowdSec analysis

[CVE-2024-34351](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-34351) is a high-severity Server-Side Request Forgery (SSRF) vulnerability in self-hosted Next.js applications using Server Actions. By modifying the `Host` header under specific redirect conditions, unauthenticated attackers may cause requests to originate from the application server, potentially accessing internal services and sensitive information. The issue is fixed in Next.js 14.1.1.

CrowdSec has been tracking this vulnerability and its exploits since 23rd of July 2026.

CrowdSec network data shows that most actors exploiting CVE-2024-34351 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2024-34351 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers target the Next.js image optimization endpoint `/_next/image`, supplying the `url` parameter with an attacker-controlled HTTP or HTTPS resource to make the server perform an outbound request. Detection should correlate requests to this endpoint with external interaction and responses such as “The requested resource isn't a valid image.”

## Timeline

- 2024-05-09: CVE Published. CVE-2024-34351 is published to NVD.
- 2026-07-23: Rule Released. CrowdSec releases a rule to detect CVE-2024-34351 exploitation attempts against the CrowdSec Network.
- 2026-07-27: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-34351 for the first time.

## References

- https://github.com/vercel/next.js/pull/62561
- https://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g
- https://github.com/vercel/next.js/commit/8f7a6ca7d21a97bc9f7a1bbe10427b5ad74b9085
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-34351.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-34351) follows observed exploitation activity for CVE-2024-34351. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.