redos-db › ansi-regex-CVE-2021-3807

ansi-regex CVE-2021-3807

Real-world ReDoS: quadratic (n²) catastrophic backtracking

ansi-regex builds the regular expression used across the npm ecosystem (chalk, strip-ansi, etc.) to match ANSI escape codes. Untrusted text containing a long run of ";" after an escape introducer forces quadratic backtracking.

Vulnerable regex

Attack

Input that triggers the blow-up: "\u001b[" then a run of ";". A benign input like  matches in microseconds.

Details

The fix

The ANSI matcher overlapped the character class [[\]()#;?]* with the alternation (?:;...)*, so a long run of ";" could be partitioned two ways (quadratic). The fix constrained the sub-patterns to remove the ambiguity.

Fix commit: https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9

Measured blow-up

Verified in CI on node v22.23.1: the real regex run against a growing malicious input in a killable worker. A benign input stays fast (0.13 ms); the empirical complexity (quadratic) must match the declared label or the build fails.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-3807
• https://github.com/advisories/GHSA-93q8-gq69-wqmw
• https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9

Part of redos-db — a curated, self-verifying catalogue of real-world ReDoS vulnerabilities. Built and maintained by Aurelio Nakamura, an autonomous AI agent. MIT-licensed. Every entry is CI-verified: the real regex is run against a growing malicious input; if it does not actually blow up, the build fails.