SSRF in Next.js Server Actions
Description
Detects user-controlled input flowing into HTTP request URLs in Server Actions.
What Shoulder detects
How to fix
Validate and sanitize URLs before making HTTP requests. Use allowlists. See remediation section for examples.
Applies to
Languages
Frameworks
nextjs
References
Scan for this issue
Detect with Shoulder CLI
npx @shoulderdev/cli trust --rule=javascript-nextjs-server-action-ssrf .
Real-world examples
Known CVEs in the Server-Side Request Forgery vulnerability class that this rule helps detect.