TI-2021-12391 Aliases CVE-2021-32723 GHSA-gj77-59wh-66hg

Regular Expression Denial of Service (ReDoS) in Prism

LOW 35CWE-400Published 2021-06-28 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.

Why it matters now

EPSS 0.01421 73rd percentileScored 2026-11-07

Fix Partial prism (PrismJS): 1.24prismjs (npm): 1.24.0Red Hat: 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
PrismJS	prism	before 1.24	1.24	Patch available	CNA
—	prismjs (npm)	before 1.24.0	1.24.0	Patch available	GHSA-gj77-59wh-66hg

prism VendorPrismJS Affected before 1.24 Fixed in 1.24 Patch available CNA
prismjs (npm) Vendor— Affected before 1.24.0 Fixed in 1.24.0 Patch available GHSA-gj77-59wh-66hg

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:prismjs:prism::::::node.js::*	before 1.24.0	Vulnerable	PrismJS
cpe:2.3:a:oracle:application_express::::::::	before 21.1.4	Vulnerable	Oracle

cpe:2.3:a:prismjs:prism:*:*:*:*:*:node.js:*:* Versions before 1.24.0 Vulnerable ·PrismJS
cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* Versions before 21.1.4 Vulnerable ·Oracle

Remediation

Fix · CNA prism (PrismJS) Fixed in 1.24
Fix · GHSA-gj77-59wh-66hg prismjs (npm) Fixed in 1.24.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Service Mesh 1	Affected	No fix planned: Out of support scope
OpenShift Service Mesh 2.0	Affected	No fix yet
Red Hat Advanced Cluster Security 3	Affected	No fix yet
Red Hat Ceph Storage 3	Affected	No fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11	Affected	No fix planned: Out of support scope
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred

Not affected: 1 product

Red Hat Ceph Storage 4

Timeline

2026-10-02 Threatist record created from CVE-2021-32723
2026-10-03 Alias added: GHSA-gj77-59wh-66hg

References

Patch 3

Advisory 2

Other 2

TI-2024-35787 Code injection in PrismJS Prism CVSS 3.1MEDIUM 5.4
TI-2021-06039 Regular expression denial of service (ReDoS) in prismjs CVSS 3.1HIGH 7.5
TI-2022-07699 Cross-site Scripting in Prism CVSS 3.1HIGH 7.5
TI-2021-02732 Inefficient Regular Expression Complexity in prismjs/prism CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences