CVE-2021-43803: Unexpected server crash in Next.js
Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-43803?
CVE-2021-43803 is a vulnerability in Next.js versions prior to 12.0.5 or 11.1.3 that could lead to a server crash when using invalid or malformed URLs.
Which versions of Next.js are affected by CVE-2021-43803?
Next.js versions above 11.1.0 and below 12.0.5 are affected by CVE-2021-43803.
Which versions of Node.js are affected by CVE-2021-43803?
Node.js versions above 15.0.0 are affected by CVE-2021-43803.
How can I mitigate the risk of CVE-2021-43803?
To mitigate the risk of CVE-2021-43803, update Next.js to version 12.0.5 or 11.1.3 and Node.js to a version below 15.0.0.
Where can I find more information about CVE-2021-43803?
You can find more information about CVE-2021-43803 in the following references: [Link1], [Link2], [Link3].