CVE-2021-3807: Inefficient Regular Expression Complexity in chalk/ansi-regex
A regular expression denial of service (ReDoS) vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes.
Other sources
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-3807?
CVE-2021-3807 is a vulnerability in ansi-regex that allows for inefficient regular expression complexity, leading to a denial of service when parsing invalid ANSI escape codes.
How severe is the vulnerability CVE-2021-3807?
The severity of CVE-2021-3807 is high, with a CVSS score of 7.5.
Which software is affected by CVE-2021-3807?
The affected software includes ansi-regex versions 3.0.0 to 3.0.1, 4.0.0 to 4.1.1, 5.0.0 to 5.0.1, and 6.0.0 to 6.0.1, as well as other packages and products mentioned in the vulnerability description.
How can I fix the vulnerability CVE-2021-3807?
To fix the vulnerability, upgrade ansi-regex to version 3.0.1, 4.1.1, 5.0.1, or 6.0.1, depending on your current version. Make sure to also update any other affected packages or products mentioned in the vulnerability description.
Where can I find more information about CVE-2021-3807?
You can find more information about CVE-2021-3807 on the NIST National Vulnerability Database (NVD) website and the GitHub page for chalk/ansi-regex.