CVE-2021-32723 is a medium-severity (CVSS 6.5) Uncontrolled Resource Consumption vulnerability in prismjs. A fix is available for prismjs — see the affected versions and patch details below.
Regular Expression Denial of Service (ReDoS) in Prism
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
prismjsnpmDescription
Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS).
Impact
When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. Do not use the following languages to highlight untrusted text.
- ASCIIDoc
- ERB
Other languages are not affected and can be used to highlight untrusted text.
Patches
This problem has been fixed in Prism v1.24.
References
- PrismJS/prism#2774
- PrismJS/prism#2688
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | prismjs | all versions | 1.24.0npm install prismjs@1.24.0 |
Affected Products
application expressoracleprismprismjsDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for prismjs, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update prismjs to 1.24.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2021-32723 is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
In OpenShift Container Platform (OCP) the affected grafana container is behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-prismjs library to authenticated users only, therefore the impact is low. Additionally, OCP 3.11 and OpenShift Service Mesh 1.1.x are in maintenance support for…
As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text.Source: Red Hat security advisory for CVE-2021-32723 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2021-32723 in your dependencies?
Find it across npm, including transitive dependencies.