CVE-2021-43803highCWE-20

CVE-2021-43803: high-severity vulnerability in vercel next.js

Unexpected server crash in Next.js

Published · Updated

Follow this CVE+ Monitor next.js+ Monitor next

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 47%
In short

Next.js versions 11.1.0–12.0.4 crash when receiving malformed URLs, causing the server to stop working temporarily. This affects websites using these specific versions with Node.js 15+.

Technical detail

Improper input validation (CWE-20) in URL parsing allows attackers to send malformed URLs that trigger an unhandled exception, resulting in denial of service. The attack vector is network-based and requires no authentication; affected deployments must use Next.js 11.1.0–12.0.4, Node.js 15.0.0+, and next start or custom servers (managed platforms like Vercel filter requests upstream).

Summary generated and translated by AI from the official description.
Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
vercel · next.js
Related CVEs — vercel next.js

In the same product, most dangerous first.

CVE-2025-29927CRITICALAuthorization Bypass in Next.js MiddlewareEPSS 99.2%CVE-2024-46982HIGHCache Poisoning in next.jsEPSS 59.2%CVE-2026-44578HIGHNext.js: Server-side request forgery in applications using WebSocket upgradesEPSS 35.5%CVE-2024-34351HIGHNext.js Server-Side Request Forgery in Server ActionsEPSS 5.5%CVE-2024-51479HIGHAuthorization bypass in Next.jsEPSS 4.0%CVE-2025-57822MEDIUMNext.js Improper Middleware Redirect Handling Leads to SSRFEPSS 2.6%