Make the server fetch a URL
Server-Side Request Forgery (SSRF)

Your app hosts a 'URL to PDF' feature. The attacker signs up and pastes a link.

1. 1
   Probe the network

   They paste http://localhost:8080 and your server dutifully tries to fetch it, then returns the response body inside the PDF.
2. 2
   Find the metadata service

   They paste http://169.254.169.254/latest/meta-data/iam/security-credentials/ and receive the IAM role name attached to your VM.
3. 3
   Steal the credentials

   One more request to the role-name path returns a working set of temporary AWS access keys. Fully scoped, fully valid.
4. 4
   Cloud takeover

   With the keys they list S3 buckets, read the production database backup, and take a quiet copy. No password was ever guessed and no code was ever exploited.

Through a single 'paste a URL' feature the attacker walked away with full read access to your cloud account.

// app/api/preview/route.ts
export async function POST(req) {
  const { url } = await req.json();

  const res = await fetch(url);
  const body = await res.text();

  return Response.json({ body });
}

// app/api/preview/route.ts
import { lookup } from 'node:dns/promises';
import { isIP } from 'node:net';

const ALLOWED_PROTOCOLS = new Set(['http:', 'https:']);

export async function POST(req) {
  const { url } = await req.json();
  const parsed = new URL(url);

  if (!ALLOWED_PROTOCOLS.has(parsed.protocol)) {
    return Response.json({ error: 'Bad scheme' }, { status: 400 });
  }

  const { address } = await lookup(parsed.hostname);
  if (isPrivateIp(address) || !isIP(address)) {
    return Response.json({ error: 'Blocked' }, { status: 400 });
  }

  const res = await fetch(parsed.toString(), { redirect: 'error' });
  const body = await res.text();
  return Response.json({ body });
}

Resolve the hostname yourself, reject private and link-local addresses, and turn off redirect following so an allowed URL cannot bounce to a blocked one. The happy path for real users is unchanged.