Vulnerability · Published Dec 9, 2021 · Assigned by GitHub_M
CVE-2021-43803Unexpected server crash in Next.js
High 7.5
In plain English
A high-severity improper input validation in next.js from vercel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 47.3% (higher than 99% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | nodejs | 0 | ALPINE-CVE-2021-43803 |
| Alpine:v3.21 | nodejs | 0 | ALPINE-CVE-2021-43803 |
| Alpine:v3.22 | nodejs | 0 | ALPINE-CVE-2021-43803 |
| Alpine:v3.23 | nodejs | 0 | ALPINE-CVE-2021-43803 |
| Alpine:v3.24 | nodejs | 0 | ALPINE-CVE-2021-43803 |
| npm | next | 12.0.5 | GHSA-25mp-g6fv-mqxx |
| npm | next | 11.1.3 | GHSA-25mp-g6fv-mqxx |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/vercel/next.js/security/advisories/GHSA-25mp-g6fv-mqxx x_refsource_CONFIRM
- https://github.com/vercel/next.js/pull/32080 x_refsource_MISC
- https://github.com/vercel/next.js/commit/6d98b4fb4315dec1badecf0e9bdc212a4272b264 x_refsource_MISC
- https://github.com/vercel/next.js/releases/tag/v11.1.3 x_refsource_MISC
- https://github.com/vercel/next.js/releases/v12.0.5 x_refsource_MISC