Link previews that fetch internal URLs for attackers
AI agents love link previews, image proxies, and import-from-URL helpers. If the server fetches whatever URL the user sends, your app becomes a tunnel into cloud metadata, localhost, and private VPC addresses.
What can go wrong
Server-side request forgery (SSRF) here means your server makes outbound HTTP requests to URLs the attacker controls or crafts.
Common vibe-coded shapes:
- A link-preview route that reads a URL from the query string and fetches it server-side
- An image proxy that loads any remote image URL through your backend
- A webhook relay or import-from-URL Server Action that forwards a user-supplied target
Without a host allowlist, private-IP blocking, and redirect protection, an attacker can aim your server at 169.254.169.254 (cloud metadata), 127.0.0.1, or internal services behind your firewall. Your app does the fetch with its credentials and network position.
A separate config mistake: Next.js images.remotePatterns with a wildcard hostname turns image optimization into an open proxy anyone can abuse.
It happened for real
JustAppSec documented the pattern across Next.js Server Components, Server Actions, and Route Handlers in March 2026, including image-proxy scaffolds and wildcard remotePatterns (JustAppSec Next.js SSRF guide).
Tomoda Hinata showed the same class on Server Actions: a hidden form field is tamperable, and "'use server' is effectively a POST endpoint" even when the UI never shows a URL box (Tomoda Hinata Server Action SSRF, 2026). Georgia Tech's Vibe Security Radar lists SSRF among top AI-attributed CWE classes in 2026 advisories.
How to check yours
Seatbelt flags this automatically. Repo scans soft-flag risky shortcuts when a url-like request field (query param, form field, or JSON body) reaches an outbound fetch in the same server file without nearby allowlist, private-IP, or redirect guards. URL Ship Read catches the same class on deployed apps. A separate info note flags wildcard remotePatterns in next.config.
Ask your agent: "List every server route and Server Action that fetches a URL from user input (link preview, image proxy, webhook relay, import from URL). Confirm each uses a host allowlist, blocks private IPs and link-local ranges, and sets redirect handling to error before the outbound call."
Manual check: In server files, search for outbound fetch calls where the target comes from the request. Trace each back to user-controlled input. Open next.config and reject image remote patterns that allow every hostname.
Fix direction
Never pass a raw user URL to fetch. Allowlist explicit hosts, block private and link-local ranges, and refuse redirects to unexpected targets.
Paste into your agent: "Find every server-side fetch driven by user input. Add validateUrl with an ALLOWED_HOSTS list, private-IP blocking, and redirect: error on outbound calls. Tighten next.config remotePatterns to hosts we actually serve."