CVE-2021-43803 Unexpected server crash in Next.js
Attackers can crash Next.js servers by sending malformed URLs, affecting deployments using specific Node.js versions and custom servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-43803?
CVE-2021-43803 is a high-severity denial of service vulnerability in Vercel Next.js, published on 9 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue.
Weakness: CWE-20
Which versions are affected by CVE-2021-43803?
4 open source packages ship an affected version, including next. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
next npm | From 0.9.9 | 11.1.3 |
next npm | From 0.9.9 | 11.1.3 |
next npm | From 12.0.0 | 12.0.5 |
next npm | From 12.0.0 | 12.0.5 |
Products include Vercel Next.js.
How do I fix CVE-2021-43803?
Upgrade next to a fixed version for your release line: 11.1.3 or 12.0.5.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-43803 being exploited?
There is no known exploitation of CVE-2021-43803 in the wild and no public exploit code.
Other vulnerabilities in Vercel Next.js
- CVE-2025-29927 Authorization Bypass in Next.js Middleware
- CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgrades
- CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
- CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Sources
Also known as CLEANSTART-2026-XA75474, GHSA-25mp-g6fv-mqxx.