BETA Shoulder is in beta — Findings may sometimes be wrong. Your feedback shapes what we fix next. Share feedback

Description

Detects user-controlled input flowing into HTTP request URLs in Server Actions.

What Shoulder detects

Server Action '{function_name}' has SSRF vulnerability: user input controls HTTP request URL

How to fix

Validate and sanitize URLs before making HTTP requests. Use allowlists.
See remediation section for examples.

Applies to

Frameworks

nextjs

References

Scan for this issue

Detect with Shoulder CLI
npx @shoulderdev/cli trust --rule=javascript-nextjs-server-action-ssrf .

Real-world examples

Known CVEs in the Server-Side Request Forgery vulnerability class that this rule helps detect.

Related rules