Next.js versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10 contain a Server‑Side Request Forgery flaw in Server Actions that allows an attacker to make the server send outbound HTTP requests to a host of the attacker’s choice by manipulating the Host header. This weakness, classified as CWE‑918, can be used to reach internal resources or external malicious hosts, potentially exposing sensitive data or enabling further exploitation.

Applications built with vercel:next.js in the affected version ranges and that use Server Actions on custom servers or deployments not behind a host‑pinned proxy are impacted. Managed hosting environments that pin the host upstream are not affected, and the issue does not affect standalone or next start output from version 14.2 onward.

The vulnerability carries a CVSS score of 8.3, indicating high severity. The EPSS score is less than 1% and the flaw is not listed in the CISA KEV catalog. The likely attack vector is an HTTP request where the attacker controls the Host header; thus any publicly exposed endpoint that accepts Server Actions without host validation can be used. Given the high CVSS and the potential to reach internal or external systems, the risk to the affected deployments is significant.