Vulnerability Description
Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vercel | Next.Js | >= 11.1.0, < 11.1.3 |
| Nodejs | Node.Js | All versions |
Related Weaknesses (CWE)
References
- https://github.com/vercel/next.js/commit/6d98b4fb4315dec1badecf0e9bdc212a4272b26PatchThird Party Advisory
- https://github.com/vercel/next.js/pull/32080PatchThird Party Advisory
- https://github.com/vercel/next.js/releases/tag/v11.1.3Release NotesThird Party Advisory
- https://github.com/vercel/next.js/releases/v12.0.5Release NotesThird Party Advisory
- https://github.com/vercel/next.js/security/advisories/GHSA-25mp-g6fv-mqxxPatchThird Party Advisory
- https://github.com/vercel/next.js/commit/6d98b4fb4315dec1badecf0e9bdc212a4272b26PatchThird Party Advisory
- https://github.com/vercel/next.js/pull/32080PatchThird Party Advisory
- https://github.com/vercel/next.js/releases/tag/v11.1.3Release NotesThird Party Advisory
- https://github.com/vercel/next.js/releases/v12.0.5Release NotesThird Party Advisory
- https://github.com/vercel/next.js/security/advisories/GHSA-25mp-g6fv-mqxxPatchThird Party Advisory
FAQ
What is CVE-2021-43803?
CVE-2021-43803 is a vulnerability with a CVSS score of 7.5 (HIGH). Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use N...
How severe is CVE-2021-43803?
CVE-2021-43803 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-43803?
Check the references section above for vendor advisories and patch information. Affected products include: Vercel Next.Js, Nodejs Node.Js.