Inefficient Regular Expression Complexity in chalk/ansi-regex
Priority MEDIUM 45CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 10 fixed, 21 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03552 89th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial chalk/ansi-regex (chalk): 6.0.1, 5.0.1ansi-regex (npm): 6.0.1, 5.0.1, 4.1.1 +1Red Hat: 13 advisoriesRed Hat: 10 fixed, 21 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| chalk | chalk/ansi-regex | before 6.0.1; before 5.0.1 | 6.0.1, 5.0.1 | Patch available | CNA |
| — | ansi-regex (npm) | 6.0.0 to before 6.0.1 | 6.0.1 | Patch available | GHSA-93q8-gq69-wqmw |
| — | ansi-regex (npm) | 5.0.0 to before 5.0.1 | 5.0.1 | Patch available | GHSA-93q8-gq69-wqmw |
| — | ansi-regex (npm) | 4.0.0 to before 4.1.1 | 4.1.1 | Patch available | GHSA-93q8-gq69-wqmw |
| — | ansi-regex (npm) | 3.0.0 to before 3.0.1 | 3.0.1 | Patch available | GHSA-93q8-gq69-wqmw |
- chalk/ansi-regex Vendorchalk Affected before 6.0.1; before 5.0.1 Fixed in 6.0.1, 5.0.1 Patch available CNA
- ansi-regex (npm) Vendor— Affected 6.0.0 to before 6.0.1 Fixed in 6.0.1 Patch available GHSA-93q8-gq69-wqmw
- ansi-regex (npm) Vendor— Affected 5.0.0 to before 5.0.1 Fixed in 5.0.1 Patch available GHSA-93q8-gq69-wqmw
- ansi-regex (npm) Vendor— Affected 4.0.0 to before 4.1.1 Fixed in 4.1.1 Patch available GHSA-93q8-gq69-wqmw
- ansi-regex (npm) Vendor— Affected 3.0.0 to before 3.0.1 Fixed in 3.0.1 Patch available GHSA-93q8-gq69-wqmw
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ansi-regex_project:ansi-regex:*:*:*:*:*:node.js:*:* | 4.0.0 to before 4.1.1 | Vulnerable | Ansi-regex Project |
| cpe:2.3:a:ansi-regex_project:ansi-regex:3.0.0:*:*:*:*:node.js:*:* | 3.0.0 | Vulnerable | Ansi-regex Project |
| cpe:2.3:a:ansi-regex_project:ansi-regex:5.0.0:*:*:*:*:node.js:*:* | 5.0.0 | Vulnerable | Ansi-regex Project |
| cpe:2.3:a:ansi-regex_project:ansi-regex:6.0.0:*:*:*:*:node.js:*:* | 6.0.0 | Vulnerable | Ansi-regex Project |
| cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* | 1.15.0 | Vulnerable | Oracle |
- cpe:2.3:a:ansi-regex_project:ansi-regex:*:*:*:*:*:node.js:*:* Versions 4.0.0 to before 4.1.1 Vulnerable ·Ansi-regex Project
- cpe:2.3:a:ansi-regex_project:ansi-regex:3.0.0:*:*:*:*:node.js:*:* Versions 3.0.0 Vulnerable ·Ansi-regex Project
- cpe:2.3:a:ansi-regex_project:ansi-regex:5.0.0:*:*:*:*:node.js:*:* Versions 5.0.0 Vulnerable ·Ansi-regex Project
- cpe:2.3:a:ansi-regex_project:ansi-regex:6.0.0:*:*:*:*:node.js:*:* Versions 6.0.0 Vulnerable ·Ansi-regex Project
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
Remediation
- Fix · CNA chalk/ansi-regex (chalk) Fixed in 6.0.1, 5.0.1
- Fix · GHSA-93q8-gq69-wqmw ansi-regex (npm) Fixed in 6.0.1 Advisory →
- Fix · GHSA-93q8-gq69-wqmw ansi-regex (npm) Fixed in 5.0.1 Advisory →
- Fix · GHSA-93q8-gq69-wqmw ansi-regex (npm) Fixed in 4.1.1 Advisory →
- Fix · GHSA-93q8-gq69-wqmw ansi-regex (npm) Fixed in 3.0.1 Advisory →
Red Hat 13 advisories
- RHSA-2023:3742 Released 2023-06-21 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.13.0 security and bug fix update
- RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-rhel9-operator +7
- RHSA-2022:6595 Released 2022-09-20 · Red Hat rating Moderatenodejs and nodejs-nodemon security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:16.16.0-1.el9_0, nodejs-docs-1:16.16.0-1.el9_0, nodejs-full-i18n-1:16.16.0-1.el9_0 +3
- RHSA-2022:6449 Released 2022-09-13 · Red Hat rating Moderatenodejs:16 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:16.16.0-3.module+el8.6.0+16248+76b0e185.aarch64::nodejs:16, nodejs-1:16.16.0-3.module+el8.6.0+16248+76b0e185.ppc64le::nodejs:16, nodejs-1:16.16.0-3.module+el8.6.0+16248+76b0e185.s390x::nodejs:16 +19
Show 10 more Red Hat advisories
- RHSA-2022:5555 Released 2022-07-14 · Red Hat rating ModerateRHV Manager (ovirt-engine) [ovirt-4.5.1] security, bug fix and update
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 apache-commons-compress-1.21-1.2.el8ev, apache-commons-compress-javadoc-1.21-1.2.el8ev, ovirt-dependencies-4.5.2-1.el8ev +1
- RHSA-2022:5532 Released 2022-07-07 · Red Hat rating ImportantRed Hat Fuse 7.11.0 release and security update
- Red Hat Fuse 7.11
- RHSA-2022:5483 Released 2022-07-01 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.2 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-ui-rhel8
- RHSA-2022:4814 Released 2022-05-31 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.6.5 security and bug fix update
- 8Base-RHMTC-1.6 rhmtc/openshift-migration-ui-rhel8, rhmtc/openshift-migration-velero-rhel8
- RHSA-2022:4711 Released 2022-05-26 · Red Hat rating ModerateRHV Manager (ovirt-engine) [ovirt-4.5.0] security update
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-4.5.0.7-0.9.el8ev, ovirt-engine-backend-4.5.0.7-0.9.el8ev, ovirt-engine-dbscripts-4.5.0.7-0.9.el8ev +19
- RHSA-2022:0735 Released 2022-03-03 · Red Hat rating ImportantRed Hat Advanced Cluster Management 2.4.2 security updates and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
- RHSA-2022:0350 Released 2022-02-01 · Red Hat rating Moderatenodejs:14 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64::nodejs:14, nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le::nodejs:14, nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x::nodejs:14 +19
- RHSA-2022:0246 Released 2022-01-25 · Red Hat rating Moderatenodejs:14 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64::nodejs:14, nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le::nodejs:14, nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x::nodejs:14 +19
- RHSA-2022:0041 Released 2022-01-06 · Red Hat rating Moderaterh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs-14.18.2-1.el7, rh-nodejs14-nodejs-devel-14.18.2-1.el7, rh-nodejs14-nodejs-docs-14.18.2-1.el7 +2
- Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs-14.18.2-1.el7, rh-nodejs14-nodejs-devel-14.18.2-1.el7, rh-nodejs14-nodejs-docs-14.18.2-1.el7 +2
- RHSA-2021:5171 Released 2021-12-16 · Red Hat rating Moderatenodejs:16 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64::nodejs:16, nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le::nodejs:16, nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x::nodejs:16 +19
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 1 | Affected | No fix planned: Out of support scope |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| Red Hat A-MQ Online | Affected | No fix planned: Out of support scope |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 4 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 5 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat Openshift Container Storage 4 | Affected | No fix planned: Out of support scope |
| Red Hat Quay 3 | Affected | No fix planned: Will not fix |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat Virtualization 4 | Affected | No fix planned: Will not fix |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| 8Base-RHMTC-1.6 | Fixed | RHSA-2022:4814 |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2022:5483 |
| RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 | Fixed | RHSA-2022:4711, RHSA-2022:5555 |
| RHODF 4.13 for RHEL 9 | Fixed | RHSA-2023:3742 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:5171, RHSA-2022:0350, RHSA-2022:6449 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:6595 |
| Red Hat Enterprise Linux AppStream EUS (v.8.4) | Fixed | RHSA-2022:0246 |
| Red Hat Fuse 7.11 | Fixed | RHSA-2022:5532 |
| Red Hat Software Collections for RHEL Workstation(v. 7) | Fixed | RHSA-2022:0041 |
| Red Hat Software Collections for RHEL(v. 7) | Fixed | RHSA-2022:0041 |
Not affected: 17 products
- 8Base-RHMTC-1.6
- 8Base-RHMTC-1.7
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
- RHODF 4.13 for RHEL 9
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ansible Automation Platform 1.2
- Red Hat Data Grid 8
- Red Hat Decision Manager 7
- Red Hat Enterprise Linux AppStream (v. 8)
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat Fuse 7
- Red Hat Integration Camel K 1
- Red Hat Integration Camel Quarkus 1
- Red Hat Integration Service Registry
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Process Automation 7
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3807
- 2026-10-03 Alias added: GHSA-93q8-gq69-wqmw
- 2026-10-08 CISA SSVC decision points changed
- 2026-10-09 Priority changed: LOW → MEDIUM
References
Patch 2
Advisory 2
Other 8
- https://github.com/chalk/ansi-regex/issues/38#issuecomment-924086311
- https://github.com/chalk/ansi-regex/issues/38#issuecomment-925924774
- https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1
- https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a
- https://github.com/chalk/ansi-regex/commit/c3c0b3f2736b9c01feec0fef33980c43720dcde8
- https://github.com/chalk/ansi-regex
- https://github.com/chalk/ansi-regex/releases/tag/v6.0.1
- https://security.netapp.com/advisory/ntap-20221014-0002
Sources
- CVE-2021-3807 · CVE Program
- CVE-2021-3807 · NVD
- FIRST EPSS
- GHSA-93q8-gq69-wqmw · GitHub Advisory Database · CC BY 4.0
- CVE-2021-3807 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences