Read the docs
TI-2021-09337 Aliases CVE-2021-28092GHSA-7r28-3m3f-r2pr

The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is…

Priority LOW 37CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time.

Why it matters now

EPSS 0.02027 81st percentileScored 2026-11-07
Fix Partial is-svg (npm): 4.2.2Red Hat: 4 advisoriesRed Hat: 2 fixed, 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—is-svg (npm)2.1.0 to before 4.2.24.2.2Patch availableGHSA-7r28-3m3f-r2pr
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • is-svg (npm) Vendor— Affected 2.1.0 to before 4.2.2 Fixed in 4.2.2 Patch available GHSA-7r28-3m3f-r2pr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:is-svg_project:is-svg:*:*:*:*:*:node.js:*:*2.1.0 – 4.2.1VulnerableIs-svg Project
  • cpe:2.3:a:is-svg_project:is-svg:*:*:*:*:*:node.js:*:* Versions 2.1.0 – 4.2.1 Vulnerable ·Is-svg Project

Remediation

  • Fix · GHSA-7r28-3m3f-r2pr is-svg (npm) Fixed in 4.2.2 Advisory →

Red Hat 4 advisories

  • RHSA-2021:3759 Released 2021-10-18 · Red Hat rating Moderate
    OpenShift Container Platform 4.9.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.9 openshift4/ose-baremetal-rhel8-operator, openshift4/ose-console, openshift4/ose-etcd +4
  • RHSA-2021:2438 Released 2021-07-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.8.2 bug fix and security update
    • Red Hat OpenShift Container Platform 4.8 openshift4/driver-toolkit-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
  • RHSA-2021:2461 Released 2021-06-16 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.2.4 security and bug fix update
    • Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 rhacm2/management-ingress-rhel7, rhacm2/memcached-exporter-rhel7, rhacm2/openshift-hive-rhel7 +2
    • Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle, rhacm2/acmesolver-rhel8 +47
Show 1 more Red Hat advisories
  • RHSA-2021:1499 Released 2021-05-04 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.2.3 security and bug fix update
    • Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 rhacm2/management-ingress-rhel7, rhacm2/memcached-exporter-rhel7, rhacm2/openshift-hive-rhel7 +2
    • Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle, rhacm2/acmesolver-rhel8 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 2.0AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat Quay 3AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4.8Fixed RHSA-2021:2438
Red Hat OpenShift Container Platform 4.9Fixed RHSA-2021:3759
Not affected: 2 products
  • Red Hat OpenShift Container Platform 4.8
  • Red Hat OpenShift Container Platform 4.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-28092
  2. 2026-10-03 Alias added: GHSA-7r28-3m3f-r2pr

References

Advisory 4

Other 3

  • TI-2021-09948 A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences