{"id":"GHSA-55xv-f85c-248q","summary":"Regular Expression Denial of Service (ReDoS) in jsx-slack","details":"jsx-slack v4.5.1 and earlier versions are vulnerable to a regular expression denial-of-service (ReDoS) attack. \n\n### Impact\n\nIf attacker can put a lot of JSX elements into `\u003cblockquote\u003e` tag, an internal regular expression for escaping characters may consume an excessive amount of computing resources.\n\n```javascript\n/** @jsxImportSource jsx-slack */\nimport { Section } from 'jsx-slack'\n\nconsole.log(\n  \u003cSection\u003e\n    \u003cblockquote\u003e\n      {[...Array(40)].map((_, i) =\u003e (\n        \u003cp\u003e{i + 1}\u003c/p\u003e\n      ))}\n    \u003c/blockquote\u003e\n  \u003c/Section\u003e\n)\n```\n\n### Patches\n\n_See also: https://github.com/yhatt/jsx-slack/security/advisories/GHSA-hp68-xhvj-x6j6_\n\njsx-slack v4.5.2 has updated regular expressions to prevent catastrophic backtracking.\n\njsx-slack v4.5.1 also had patched a workaround. It has no problems to contents with ASCII characters, but _still vulnerable to contents with multibyte characters_. (https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d)\n\n### References\n\n- https://nvd.nist.gov/vuln/detail/CVE-2021-43838\n- https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d\n\n### Credits\n\nThanks to @hieki for finding out this vulnerability.","aliases":["CVE-2021-43838"],"modified":"2026-07-08T06:26:54.469704888Z","published":"2021-12-17T19:59:02Z","related":["CVE-2021-43843"],"database_specific":{"github_reviewed":true,"github_reviewed_at":"2021-12-17T19:33:23Z","nvd_published_at":"2021-12-17T19:15:00Z","cwe_ids":["CWE-1333","CWE-400"],"severity":"LOW"},"references":[{"type":"WEB","url":"https://github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f85c-248q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43838"},{"type":"WEB","url":"https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d"},{"type":"WEB","url":"https://github.com/yhatt/jsx-slack"}],"affected":[{"package":{"name":"jsx-slack","ecosystem":"npm","purl":"pkg:npm/jsx-slack"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-55xv-f85c-248q/GHSA-55xv-f85c-248q.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}