A server-side request forgery vulnerability in Vercel Next.js versions 14.x and 16.x poses a significant risk of unauthorized data access.

This is a server-side request forgery (SSRF) vulnerability (CWE-918) that allows an unauthenticated attacker to manipulate requests made by the server.

An SSRF vulnerability can be leveraged to bypass network controls, allowing attackers to interact with internal services that are not exposed to the public internet. With a CVSS score of 8.3, this flaw represents a high risk to data confidentiality, as it may allow for the exfiltration of sensitive information from internal metadata services or private network resources.

Immediate Action: Update the Next.js dependency in all projects to version 15.5.21 or 16.2.11 via npm or your preferred package manager.

Proactive Monitoring: Review web application firewall logs for suspicious outbound requests originating from the application server that target internal IP ranges.

Compensating Controls: Implement strict egress filtering on the application server to prevent connections to internal infrastructure that are not required for application functionality.

Public Exploit Available: Unknown.

Developers should treat this vulnerability with high urgency and update their Next.js dependencies immediately. Failure to patch may allow attackers to bypass perimeter security and access backend services or sensitive configuration data.