VYPR
← All advisories
High severityNVD Advisory· Published Sep 17, 2021· Updated Aug 3, 2024

Inefficient Regular Expression Complexity in chalk/ansi-regex

CVE-2021-3807

Description

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ansi-regex is vulnerable to ReDoS; a crafted string can cause excessive CPU consumption and denial of service.

Vulnerability

The ansi-regex package contains a regular expression vulnerable to inefficient regular expression complexity (ReDoS) [1]. The vulnerability resides in the pattern used to match ANSI escape codes, which exhibits exponential backtracking under certain conditions [2].

Exploitation

An attacker can exploit this by supplying a specially crafted string as input to any application that processes user-controlled text through ansi-regex. No authentication or special privileges are required. The crafted input triggers catastrophic backtracking, causing the regex engine to consume excessive CPU time [2].

Impact

Successful exploitation results in a denial of service (DoS) condition, rendering the application unresponsive due to high CPU utilization. This affects the availability of the service [1].

Mitigation

The vulnerability has been fixed in commits `8d1d7cd` [3] and `419250f` [4]. Users should update to the latest patched version (e.g., v5.0.1 or later) to mitigate the risk.

References
  1. NVD - CVE-2021-3807
  2. Snyk Vulnerability Database | Snyk
  3. Fix potential ReDoS (#37) · chalk/ansi-regex@419250f
  4. Fix potential ReDoS (#37) · chalk/ansi-regex@8d1d7cd

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
ansi-regexnpm
>= 6.0.0, < 6.0.16.0.1
ansi-regexnpm
>= 5.0.0, < 5.0.15.0.1
ansi-regexnpm
>= 4.0.0, < 4.1.14.1.1
ansi-regexnpm
>= 3.0.0, < 3.0.13.0.1

Affected products

184

Patches

4
c3c0b3f2736b

Fix potential ReDoS (#37)

https://github.com/chalk/ansi-regexYeting LiSep 10, 2021via ghsa
commit
1 file changed · +1 −1
  • index.js+1 −1 modified
    @@ -2,7 +2,7 @@
 
 module.exports = ({onlyFirst = false} = {}) => {
 	const pattern = [
-		'[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:[a-zA-Z\\d]*(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)',
+	    '[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)',
 		'(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-ntqry=><~]))'
 	].join('|');
419250fa510b

Fix potential ReDoS (#37)

https://github.com/chalk/ansi-regexYeting LiSep 10, 2021via ghsa
commit
1 file changed · +1 −1
  • index.js+1 −1 modified
    @@ -2,7 +2,7 @@
 
 module.exports = () => {
 	const pattern = [
-		'[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:[a-zA-Z\\d]*(?:;[a-zA-Z\\d]*)*)?\\u0007)',
+		'[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[a-zA-Z\\d]*)*)?\\u0007)',
 		'(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PRZcf-ntqry=><~]))'
 	].join('|');
75a657da7af8

Fix potential ReDoS (#37)

https://github.com/chalk/ansi-regexYeting LiSep 10, 2021via ghsa
commit
1 file changed · +1 −1
  • index.js+1 −1 modified
    @@ -6,7 +6,7 @@ module.exports = options => {
 	}, options);
 
 	const pattern = [
-		'[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:[a-zA-Z\\d]*(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)',
+		'[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)',
 		'(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-ntqry=><~]))'
 	].join('|');
8d1d7cdb5862

Fix potential ReDoS (#37)

https://github.com/chalk/ansi-regexYeting LiSep 10, 2021via ghsa
commit
1 file changed · +1 −1
  • index.js+1 −1 modified
    @@ -1,6 +1,6 @@
 export default function ansiRegex({onlyFirst = false} = {}) {
 	const pattern = [
-		'[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:[a-zA-Z\\d]*(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)',
+	    '[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)',
 		'(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-ntqry=><~]))'
 	].join('|');

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

14

News mentions

0

No linked articles in our index yet.