Read the docs
TI-2021-19609 Aliases CVE-2021-43803GHSA-25mp-g6fv-mqxx

Unexpected server crash in Next.js

Priority MEDIUM 63CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue.

Why it matters now

EPSS 0.47254 98th percentileScored 2026-11-07
Fix Fixed next.js (vercel): 11.1.3, 12.0.5next (npm): 12.0.5, 11.1.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
vercelnext.js11.1.0 to before 11.1.3; 12.0.0 to before 12.0.511.1.3, 12.0.5Patch availableCNA
—next (npm)12.0.0 to before 12.0.512.0.5Patch availableGHSA-25mp-g6fv-mqxx
—next (npm)0.9.9 to before 11.1.311.1.3Patch availableGHSA-25mp-g6fv-mqxx
  • next.js Vendorvercel Affected 11.1.0 to before 11.1.3; 12.0.0 to before 12.0.5 Fixed in 11.1.3, 12.0.5 Patch available CNA
  • next (npm) Vendor— Affected 12.0.0 to before 12.0.5 Fixed in 12.0.5 Patch available GHSA-25mp-g6fv-mqxx
  • next (npm) Vendor— Affected 0.9.9 to before 11.1.3 Fixed in 11.1.3 Patch available GHSA-25mp-g6fv-mqxx

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*11.1.0 to before 11.1.3; 12.0.0 to before 12.0.5Vulnerablevercel
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*after 15.0.0Running onNodeJS
  • cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* Versions 11.1.0 to before 11.1.3; 12.0.0 to before 12.0.5 Vulnerable ·vercel
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* Versions after 15.0.0 Running on ·NodeJS

Remediation

  • Fix · CNA next.js (vercel) Fixed in 11.1.3, 12.0.5
  • Fix · GHSA-25mp-g6fv-mqxx next (npm) Fixed in 12.0.5 Advisory →
  • Fix · GHSA-25mp-g6fv-mqxx next (npm) Fixed in 11.1.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-43803
  2. 2026-10-03 Alias added: GHSA-25mp-g6fv-mqxx

References

Patch 3

Advisory 3

Other 1

  • TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-21309 Authorization Bypass in Next.js Middleware CVSS 3.1CRITICAL 9.1
  • TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
  • TI-2024-31371 Cache Poisoning in next.js CVSS 3.1HIGH 7.5
  • TI-2023-24914 Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch… CVSS 3.1HIGH 7.5
  • TI-2026-32490 Next.js: Server-side request forgery in applications using WebSocket upgrades CVSS 3.1HIGH 8.6
See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences