CVE-2021-43803

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue.

• CWE-20

• https://github.com/vercel/next.js/commit/6d98b4fb4315dec1badecf0e9bdc212a4272b264Patch, Third Party Advisory
• https://github.com/vercel/next.js/pull/32080Patch, Third Party Advisory
• https://github.com/vercel/next.js/releases/tag/v11.1.3Release Notes, Third Party Advisory
• https://github.com/vercel/next.js/releases/v12.0.5Release Notes, Third Party Advisory
• https://github.com/vercel/next.js/security/advisories/GHSA-25mp-g6fv-mqxxPatch, Third Party Advisory
• https://github.com/vercel/next.js/commit/6d98b4fb4315dec1badecf0e9bdc212a4272b264Patch, Third Party Advisory
• https://github.com/vercel/next.js/pull/32080Patch, Third Party Advisory
• https://github.com/vercel/next.js/releases/tag/v11.1.3Release Notes, Third Party Advisory
• https://github.com/vercel/next.js/releases/v12.0.5Release Notes, Third Party Advisory
• https://github.com/vercel/next.js/security/advisories/GHSA-25mp-g6fv-mqxxPatch, Third Party Advisory

Published

Dec 10, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43798Grafana is an open-source platform for monitoring and observ…7.5
• CVE-2021-43799Zulip is an open-source team collaboration tool. Zulip Serve…9.8
• CVE-2021-4380The Pinterest Automatic plugin for WordPress is vulnerable t…9.8
• CVE-2021-43800Wiki.js is a wiki app built on Node.js. Prior to version 2.5…7.5
• CVE-2021-43801Mercurius is a GraphQL adapter for Fastify. Any users from M…7.5
• CVE-2021-43802Etherpad is a real-time collaborative editor. In versions pr…8.8
• CVE-2021-43804PJSIP is a free and open source multimedia communication lib…7.3
• CVE-2021-43805Solidus is a free, open-source ecommerce platform built on R…7.5
• CVE-2021-43806Tuleap is a Libre and Open Source tool for end to end tracea…8.8
• CVE-2021-43807Opencast is an Open Source Lecture Capture & Video Managemen…6.5
• CVE-2021-43808Laravel is a web application framework. Laravel prior to ver…6.1
• CVE-2021-43809`Bundler` is a package for managing application dependencies…7.3