CVE-2021-43803 describes a server crash vulnerability in Next.js versions 11.1.0 through 12.0.4 when deployed with Node.js 15.0.0+ using next start or a custom server. This high-severity vulnerability (CVSS 7.5) allows an unauthenticated attacker to cause a denial of service by sending invalid or malformed URLs. While no public exploits or active exploitation have been observed, and community discussion is minimal, affected organizations should prioritize upgrading to Next.js 12.0.5 or 11.1.3 to mitigate this risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 11.1.0, < 11.1.3CPE matchmatch criteria | cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* | ||
>= 12.0.0, < 12.0.5CPE matchmatch criteria | cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.