CVE-2021-43803

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-43803
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-43803.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-43803
Aliases
Downstream
ALPINE (1)
BELL (1)
CLEANSTART (14)
Published
2021-12-10T00:15:11Z
Modified
2026-10-16T02:50:41Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue.

References

Affected packages

Git / github.com/vercel/next.js

Affected ranges

Type
GIT
Repo
https://github.com/vercel/next.js
Events
Introduced
ce4adfc02d3532e2c62ed8088660df1655e66278
Fixed
ec1a0f7643172e5beba96e7be7d000471813cf69
Introduced
8a450db14a1b29d506ec86df1a002bc525ab0da7
Fixed
b6162bb6b6b46788ef2ae700d81c99e94d903900
Fixed
6d98b4fb4315dec1badecf0e9bdc212a4272b264
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "range": [
                {
                    "introduced": "11.1.0"
                },
                {
                    "fixed": "11.1.3"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "range": [
                {
                    "introduced": "12.0.0"
                },
                {
                    "fixed": "12.0.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "6d98b4fb4315dec1badecf0e9bdc212a4272b264"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v11.1.3",
            "range": [
                {
                    "fixed": "ec1a0f7643172e5beba96e7be7d000471813cf69"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v11.*
v11.1.0
v11.1.1
v11.1.1-canary.0
v11.1.1-canary.1
v11.1.1-canary.10
v11.1.1-canary.11
v11.1.1-canary.12
v11.1.1-canary.13
v11.1.1-canary.14
v11.1.1-canary.15
v11.1.1-canary.16
v11.1.1-canary.17
v11.1.1-canary.18
v11.1.1-canary.19
v11.1.1-canary.2
v11.1.1-canary.3
v11.1.1-canary.4
v11.1.1-canary.5
v11.1.1-canary.6
v11.1.1-canary.7
v11.1.1-canary.8
v11.1.1-canary.9
v11.1.2
v11.1.2-canary.0
v12.*
v12.0.0
v12.0.1
v12.0.1-canary.0
v12.0.1-canary.1
v12.0.1-canary.2
v12.0.1-canary.3
v12.0.1-canary.4
v12.0.1-canary.5
v12.0.2
v12.0.2-canary.0
v12.0.2-canary.1
v12.0.2-canary.10
v12.0.2-canary.11
v12.0.2-canary.12
v12.0.2-canary.13
v12.0.2-canary.14
v12.0.2-canary.2
v12.0.2-canary.3
v12.0.2-canary.4
v12.0.2-canary.5
v12.0.2-canary.6
v12.0.2-canary.7
v12.0.2-canary.8
v12.0.2-canary.9
v12.0.3
v12.0.3-canary.0
v12.0.3-canary.1
v12.0.3-canary.10
v12.0.3-canary.2
v12.0.3-canary.3
v12.0.3-canary.4
v12.0.3-canary.5
v12.0.3-canary.6
v12.0.3-canary.7
v12.0.3-canary.8
v12.0.3-canary.9
v12.0.4
v12.0.4-canary.0
v12.0.4-canary.1
v12.0.4-canary.10
v12.0.4-canary.11
v12.0.4-canary.12
v12.0.4-canary.13
v12.0.4-canary.14
v12.0.4-canary.15
v12.0.4-canary.2
v12.0.4-canary.3
v12.0.4-canary.4
v12.0.4-canary.5
v12.0.4-canary.6
v12.0.4-canary.8
v12.0.4-canary.9
v12.0.5-canary.0
v12.0.5-canary.1
v12.0.5-canary.10
v12.0.5-canary.11
v12.0.5-canary.12
v12.0.5-canary.13
v12.0.5-canary.14
v12.0.5-canary.16
v12.0.5-canary.2
v12.0.5-canary.3
v12.0.5-canary.4
v12.0.5-canary.5
v12.0.5-canary.6
v12.0.5-canary.7
v12.0.5-canary.8
v12.0.5-canary.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-43803.json"