What’s Vulnerable › Vulnerabilities

CVE-2021-3807: Inefficient Regular Expression Complexity in chalk/ansi-regex

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-09-17 · updated 2026-10-08
• Weakness: CWE-1333

Description

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Affected products

• Ansi-Regex Project Ansi-Regex: from 4.0.0 before 4.1.1; 3.0.0, 5.0.0, 6.0.0 — fixed in 4.1.1
• Oracle Communications Cloud Native Core Policy: 1.15.0
• Npm Ansi-Regex: from 6.0.0 before 6.0.1; from 5.0.0 before 5.0.1; from 4.0.0 before 4.1.1; from 3.0.0 before 3.0.1 — fixed in 6.0.1, 5.0.1, 4.1.1, 3.0.1

How to fix

Upgrade to a fixed version: Ansi-Regex Project Ansi-Regex 4.1.1; Npm Ansi-Regex 6.0.1, 5.0.1, 4.1.1, 3.0.1. Check the vendor advisory for mitigations.

References

• https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9
• https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994
• https://security.netapp.com/advisory/ntap-20221014-0002/
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9
• https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994
• https://security.netapp.com/advisory/ntap-20221014-0002/
• https://www.oracle.com/security-alerts/cpuapr2022.html

Get alerted when CVE-2021-3807 or the next vulnerability affects your stack