TI-2021-06039 Aliases CVE-2021-23341 GHSA-h4hr-7fg3-h35w

Regular expression denial of service (ReDoS) in prismjs

LOW 39CWE-400Published 2021-02-18 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components.

Why it matters now

EPSS 0.03167 88th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial prismjs: 1.23.0prismjs (npm): 1.23.0Red Hat: 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	prismjs	before 1.23.0	1.23.0	Patch available	CNA
—	prismjs (npm)	before 1.23.0	1.23.0	Patch available	GHSA-h4hr-7fg3-h35w

prismjs Vendor— Affected before 1.23.0 Fixed in 1.23.0 Patch available CNA
prismjs (npm) Vendor— Affected before 1.23.0 Fixed in 1.23.0 Patch available GHSA-h4hr-7fg3-h35w

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:prismjs:prism::::::node.js::*	before 1.23.0	Vulnerable	PrismJS

cpe:2.3:a:prismjs:prism:*:*:*:*:*:node.js:*:* Versions before 1.23.0 Vulnerable ·PrismJS

Remediation

Fix · CNA prismjs Fixed in 1.23.0
Fix · GHSA-h4hr-7fg3-h35w prismjs (npm) Fixed in 1.23.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Service Mesh 2.0	Affected	No fix planned: Will not fix
Red Hat Ceph Storage 3	Affected	No fix planned: Will not fix
Red Hat Ceph Storage 4	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 4	Affected	No fix planned: Will not fix

Timeline

2026-10-02 Threatist record created from CVE-2021-23341
2026-10-03 Alias added: GHSA-h4hr-7fg3-h35w

References

Exploit 1

https://github.com/PrismJS/prism/issues/2583

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-23341

Other 1

https://www.npmjs.com/package/prismjs

TI-2024-35787 Code injection in PrismJS Prism CVSS 3.1MEDIUM 5.4
TI-2022-07699 Cross-site Scripting in Prism CVSS 3.1HIGH 7.5
TI-2021-12391 Regular Expression Denial of Service (ReDoS) in Prism CVSS 3.1HIGH 7.4
TI-2021-02732 Inefficient Regular Expression Complexity in prismjs/prism CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences