SSRF
3 articles with this tag
Do Next.js and React Have a Lot of Vulnerabilities? What the CVE Data Actually Shows
The data says React core has almost no CVEs while Next.js CVEs are numerous and rising. What matters is where they are: they land in middleware, caching, image optimization and Server Actions, with SSRF, deserialization and authorization bypass leading the CWEs. This site's conclusion: Next.js should not be treated as only a front-end framework. It runs as a server, so defend it like one: authorize again at the data, allow-list outbound fetches, and put Server Action endpoints behind auth.
What is SSRF (Server-Side Request Forgery)
SSRF abuses external-input URLs to make a server access internal resources (internal IPs, cloud metadata). If you fetch URLs, you need an allowlist of destinations, internal-target blocking, and protection against redirect/DNS-rebinding bypasses. It was the cause of the Capital One breach.
Capital One breach (2019) — how SSRF leaked 100M+ records, and how to defend
A single SSRF reached the metadata endpoint → over-privileged IAM temporary credentials → bulk S3 copy, leaking ~106M records. Every step could have stopped it. In your environment: IMDSv2, IAM least privilege, and an allowlist for outbound fetches.