How severe is GHSA-7wwv-vh3v-89cq?

No CVSS score has been assigned to GHSA-7wwv-vh3v-89cq yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-7wwv-vh3v-89cq?

GHSA-7wwv-vh3v-89cq affects the following packages: highlight.js (npm), @highlightjs/cdn-assets (npm). Ecosystems affected: npm.

How do I fix GHSA-7wwv-vh3v-89cq?

Update highlight.js to 10.4.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-7wwv-vh3v-89cq is resolved across your whole dependency graph.

How do I detect GHSA-7wwv-vh3v-89cq in my npm dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for highlight.js. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-7wwv-vh3v-89cq if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-7wwv-vh3v-89cq?

O3 pinpoints whether GHSA-7wwv-vh3v-89cq is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-7wwv-vh3v-89cq actively exploited in the wild?

No public exploit code has been indexed for GHSA-7wwv-vh3v-89cq yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-7wwv-vh3v-89cq published, and has it been updated?

GHSA-7wwv-vh3v-89cq was published on December 4, 2020 and was last updated on July 8, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦 npm

Not in CISA KEV

GHSA-7wwv-vh3v-89cq

Fix: highlightjs/highlight.js@373b9d8

GHSA-7wwv-vh3v-89cq is a security vulnerability in highlight.js. O3 Security confirms whether GHSA-7wwv-vh3v-89cq is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

ReDOS vulnerabities: multiple grammars

Published

Dec 4, 2020

Updated

Jul 8, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

None indexed

Exploitation data as of Jul 8, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

8Kother npm packages depend on this — each one inherits the vulnerability until it's patched upstream

highlight.jsnpm

33.7Mdownloads / week

@highlightjs/cdn-assetsnpm

90Kdownloads / week

Description

Impact: Potential ReDOS vulnerabilities (exponential and polynomial RegEx backtracking)

oswasp:

The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.

If are you are using Highlight.js to highlight user-provided data you are possibly vulnerable. On the client-side (in a browser or Electron environment) risks could include lengthy freezes or crashes... On the server-side infinite freezes could occur... effectively preventing users from accessing your app or service (ie, Denial of Service).

This is an issue with grammars shipped with the parser (and potentially 3rd party grammars also), not the parser itself. If you are using Highlight.js with any of the following grammars you are vulnerable. If you are using highlightAuto to detect the language (and have any of these grammars registered) you are vulnerable. Exponential grammars (C, Perl, JavaScript) are auto-registered when using the common grammar subset/library require('highlight.js/lib/common') as of 10.4.0 - see https://cdn.jsdelivr.net/gh/highlightjs/[email protected]/build/highlight.js

All versions prior to 10.4.1 are vulnerable, including version 9.18.5.

Grammars with exponential backtracking issues:

c-like (c, cpp, arduino)
handlebars (htmlbars)
gams
perl
jboss-cli
r
erlang-repl
powershell
routeros
livescript (10.4.0 and 9.18.5 included this fix)
javascript & typescript (10.4.0 included partial fixes)

And of course any aliases of those languages have the same issue. ie: hpp is no safer than cpp.

Grammars with polynomial backtracking issues:

kotlin
gcode
d
aspectj
moonscript
coffeescript/livescript
csharp
scilab
crystal
elixir
basic
ebnf
ruby
fortran/irpf90
livecodeserver
yaml
x86asm
dsconfig
markdown
ruleslanguage
xquery
sqf

And again: any aliases of those languages have the same issue. ie: ruby and rb share the same ruby issues.

Patches

Version 10.4.1 resolves these vulnerabilities. Please upgrade.

Workarounds / Mitigations

Discontinue use the affected grammars. (or perhaps use only those with poly vs exponential issues)
Attempt cherry-picking the grammar fixes into older versions...
Attempt using newer CDN versions of any affected languages. (ie using an older CDN version of the library with newer CDN grammars). Your mileage may vary.

References

https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

For more information

If you have any questions or comments about this advisory:

Open an issue: https://github.com/highlightjs/highlight.js/issues
Email us at [email protected]

Affected Packages

2 total 2 fixed

Ecosystem	Package	Vulnerable range	Fix
📦npm	`highlight.js`	≥ 9.0.0&&< 10.4.1	10.4.1
📦npm	`@highlightjs/cdn-assets`	all versions	10.4.1

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for highlight.js. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update highlight.js to 10.4.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-7wwv-vh3v-89cq is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-7wwv-vh3v-89cq is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-7wwv-vh3v-89cq. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Impact: Potential ReDOS vulnerabilities (exponential and polynomial RegEx backtracking) [oswasp](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS): > The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time. If are you are using

O3 Security · Impact-Aware SCA

Is GHSA-7wwv-vh3v-89cq in your dependencies?

O3 detects GHSA-7wwv-vh3v-89cq across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works