{"action":"Upgrade next to 14.1.1 or later.","affected":[{"fixed":"14.1.1","introduced":"13.4.0"}],"component":"next","cve_ids":["CVE-2024-34351"],"ecosystem":"npm","epss":0.05453,"exploited":false,"fixed_versions":["14.1.1"],"ghsa_id":"GHSA-fr5h-rqp8-mj6g","id":"tcs_01M5KFP4NKDHJWEBYS4RSZBGJT","modified_at":"2026-09-10T03:50:00.353665045Z","published_at":"2024-05-09T21:18:57Z","references":["https://osv.dev/vulnerability/GHSA-fr5h-rqp8-mj6g","https://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g","https://nvd.nist.gov/vuln/detail/CVE-2024-34351","https://github.com/vercel/next.js/pull/62561","https://github.com/vercel/next.js/commit/8f7a6ca7d21a97bc9f7a1bbe10427b5ad74b9085","https://github.com/vercel/next.js"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-fr5h-rqp8-mj6g","url":"https://osv.dev/vulnerability/GHSA-fr5h-rqp8-mj6g"}],"summary":"Next.js Server-Side Request Forgery in Server Actions"}