VulnSocial

CVE-2024-34351General(vercel / next.js)

LOWCVSS 7.5 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for vercel next.js systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. The required conditions are 1) Next.js is running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server Action performs a redirect to a relative path which starts with a `/`. This vulnerability was fixed in Next.js `14.1.1`.

vercel CVEsBack to dashboard
3.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • next.js

Threat summary

  • Active exploitation appears in 1 classified signals
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Technical details provided in 2 signals
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-06-10); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
vercel
Products
next.js

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-10: 1Mentions · 2026-09-14: 1Active Exploitation · 2026-09-14: 1Technical Details · 2026-06-10: 1Technical Details · 2026-09-14: 106-1009-14
Signal classification2 categories
General
150.0%
Active Exploitation
150.0%
Classification over time
DateTotalLabels
2026-06-101
General1
2026-09-141
Active Exploitation1
Full discourse2 posts
  • Ed@thee_aiguy
    General

    CVE-2024-34351 in Next.js is a good reminder that SSRF isn't a solved problem. full-read SSRF through a popular framework used by millions of production apps. the attack surface keeps growing as the abstraction layers pile up

    Post summary

    The statement highlights a full‑read SSRF vulnerability in Next.js (CVE‑2024‑34351) and notes its prevalence, but it provides no PoC, exploit code, active usage data, or patch information.

    01050107
    1.5K followersView on X
  • sicehice@sicehice
    Active Exploitation

    #RCE attempt targeting Langflow (CVE-2024-34351) 2026-09-14 00:44:14 UTC Source IP: 91.92.40.236 🇸🇪 POST / IOCs: hxxp://217.60.195.239/x86 217.60.195.239 🇦🇪 be809872eb1115c985a6685e54790bb4 https://t.co/qRxp3ZD1La

    Post summary

    The text documents an active RCE attack attempt against Langflow (CVE-2024-34351) observed from a Swedish IP address, providing specific IOCs including a payload download URL and file hash, suggesting real-world exploitation activity.

    01011237
    1.7K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appvercelnext.js-node.js-

Explore more

Back to dashboardvercel CVEsnext.js vulnerabilities