7.5

CVE-2021-43803: vercel next.js Improper Input Validation

CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2021-43803GHSA-25mp-g6fv-mqxx
Published 09-12-2021Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2021-43803 is a high (CVSS 7.5) Improper Input Validation vulnerability in vercel next.js. EPSS estimates a 47.25% chance of exploitation in the next 30 days, higher than 98.8% of scored vulnerabilities.

Overall risk
39/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
47.25%
0%100%
High · +2.43 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 09-12-2021
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

47.25%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

+2.43 pp

From 44.82% on 20-09-2026

20-09-202620-10-2026
EPSS score
47.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Alpine1 product
  • nodejsAll versions (No fix recorded)
Npm1 product
  • next≥ 12.0.0, < 12.0.5 | ≥ 0.9.9, < 11.1.3
Vercel1 product
  • next.js≥ 11.1.0, < 11.1.3 | ≥ 12.0.0, < 12.0.5

3 vendors · 3 products

References

8 links