High
Security advisory
Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-43803
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:00 UTC · Revision 1
Source evidence
Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue.
osv:CVE-2021-43803
Complete source record
{
"id": "65d879ed342fd87f10aab211197d87cf27da248b8844d73e419db32cc38fc262",
"url": "https://osv.dev/vulnerability/CVE-2021-43803",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-43803",
"summary": "Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue.",
"evidence": "osv:CVE-2021-43803",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2021-43803",
"aliases": [
"CVE-2021-43803",
"GHSA-25mp-g6fv-mqxx"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/vercel/next.js",
"type": "GIT",
"events": [
{
"introduced": "ce4adfc02d3532e2c62ed8088660df1655e66278"
},
{
"fixed": "ec1a0f7643172e5beba96e7be7d000471813cf69"
},
{
"introduced": "8a450db14a1b29d506ec86df1a002bc525ab0da7"
},
{
"fixed": "b6162bb6b6b46788ef2ae700d81c99e94d903900"
},
{
"fixed": "6d98b4fb4315dec1badecf0e9bdc212a4272b264"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "11.1.0"
},
{
"fixed": "11.1.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "12.0.0"
},
{
"fixed": "12.0.5"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "6d98b4fb4315dec1badecf0e9bdc212a4272b264"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "ec1a0f7643172e5beba96e7be7d000471813cf69"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v11.1.3"
}
]
}
}
],
"versions": [
"v11.1.2",
"v12.0.5-canary.16",
"v12.0.5-canary.14",
"v12.0.5-canary.13",
"v12.0.5-canary.12",
"v12.0.5-canary.11",
"v12.0.5-canary.10",
"v12.0.5-canary.9",
"v12.0.5-canary.8",
"v12.0.5-canary.7",
"v12.0.5-canary.6",
"v12.0.5-canary.5",
"v12.0.5-canary.4",
"v12.0.5-canary.3",
"v12.0.5-canary.2",
"v12.0.5-canary.1",
"v12.0.5-canary.0",
"v12.0.4",
"v12.0.4-canary.15",
"v12.0.4-canary.14",
"v12.0.4-canary.13",
"v12.0.4-canary.12",
"v12.0.4-canary.11",
"v12.0.4-canary.10",
"v12.0.4-canary.9",
"v12.0.4-canary.8",
"v12.0.4-canary.6",
"v12.0.4-canary.5",
"v12.0.4-canary.4",
"v12.0.4-canary.3",
"v12.0.4-canary.2",
"v12.0.4-canary.1",
"v12.0.4-canary.0",
"v12.0.3",
"v12.0.3-canary.10",
"v12.0.3-canary.9",
"v12.0.3-canary.8",
"v12.0.3-canary.7",
"v12.0.3-canary.6",
"v12.0.3-canary.5",
"v12.0.3-canary.4",
"v12.0.3-canary.3",
"v12.0.3-canary.2",
"v12.0.3-canary.1",
"v12.0.3-canary.0",
"v12.0.2",
"v12.0.2-canary.14",
"v12.0.2-canary.13",
"v12.0.2-canary.12",
"v12.0.2-canary.11",
"v12.0.2-canary.10",
"v12.0.2-canary.9",
"v12.0.2-canary.8",
"v12.0.2-canary.7",
"v12.0.2-canary.6",
"v12.0.2-canary.5",
"v12.0.2-canary.4",
"v12.0.2-canary.3",
"v12.0.2-canary.2",
"v12.0.2-canary.1",
"v12.0.2-canary.0",
"v12.0.1",
"v12.0.1-canary.5",
"v12.0.1-canary.4",
"v12.0.1-canary.3",
"v12.0.1-canary.2",
"v12.0.1-canary.1",
"v12.0.1-canary.0",
"v12.0.0",
"v11.1.2-canary.0",
"v11.1.1",
"v11.1.1-canary.19",
"v11.1.1-canary.18",
"v11.1.1-canary.17",
"v11.1.1-canary.16",
"v11.1.1-canary.15",
"v11.1.1-canary.14",
"v11.1.1-canary.13",
"v11.1.1-canary.12",
"v11.1.1-canary.11",
"v11.1.1-canary.10",
"v11.1.1-canary.9",
"v11.1.1-canary.8",
"v11.1.1-canary.7",
"v11.1.1-canary.6",
"v11.1.1-canary.5",
"v11.1.1-canary.4",
"v11.1.1-canary.3",
"v11.1.1-canary.2",
"v11.1.1-canary.1",
"v11.1.1-canary.0",
"v11.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-43803.json"
}
}
],
"modified": "2026-10-20T10:55:03.370215677Z",
"provider": "osv",
"references": [
"https://github.com/vercel/next.js/releases/tag/v11.1.3",
"https://github.com/vercel/next.js/releases/v12.0.5",
"https://github.com/vercel/next.js/commit/6d98b4fb4315dec1badecf0e9bdc212a4272b264",
"https://github.com/vercel/next.js/pull/32080",
"https://github.com/vercel/next.js/security/advisories/GHSA-25mp-g6fv-mqxx"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-43803",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 386796,
"published_at": "2021-12-10T00:15:11.827+00:00"
}