Next.js
Next.js CVE-2024-34351: The Host Header Is User Input
How a relative redirect in Next.js Server Actions became SSRF, and why internal requests must never build URLs from the Host header.
Topic
Next.js
A collection of essays to explore, one idea at a time.