CVE-2021-43803

published 2021-12-10

CVE-2021-43803: Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected…

Priority P3 58 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
next	next	>= 0.9.9 < 11.1.3	11.1.3
next	next	>= 12.0.0 < 12.0.5	12.0.5
nodejs	nodejs	>= 0 < 0	0
nodejs	nodejs	>= 0 < 0	0
nodejs	nodejs	>= 0 < 0	0
nodejs	nodejs	>= 0 < 0	0
nodejs	nodejs	>= 0 < 0	0
nodejs	nodejs	>= 0 < 0	0
nodejs	nodejs	>= 0 < 0	0
nodejs	nodejs	>= 0 < 0	0
nodejs	nodejs	>= 0 < 0	0
vercel	next.js	—	—
vercel	next.js	—	—
vercel	next.js	>= 11.1.0 < 11.1.3	11.1.3
vercel	next.js	>= 12.0.0 < 12.0.5	12.0.5

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:N/A:P

osv 7.5 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20