Inefficient Regular Expression Complexity in chalk/ansi-regex

Description

ansi-regex is vulnerable to Inefficient Regular Expression Complexity which could lead to a denial of service when parsing invalid ANSI escape codes.

Proof of Concept

The ReDOS is mainly due to the sub-patterns [[\\]()#;?]* and (?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*){:target="_blank"}{:rel="noopener noreferrer"}*

Recommendation

Update the ansi-regex package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 3.0.0, < 3.0.1

  >= 4.0.0, < 4.1.1

  >= 5.0.0, < 5.0.1

  >= 6.0.0, < 6.0.1**

• Patched version(s): **3.0.1

  4.1.1

  5.0.1

  6.0.1**

References

• GHSA-93q8-gq69-wqmw
• huntr.dev
• app.snyk.io
• www.oracle.com
• security.netapp.com
• CVE-2021-3807
• CWE-1333
• CWE-697
• CAPEC-310
• OWASP 2021-A6

Related Issues

• axios Inefficient Regular Expression Complexity vulnerability - CVE-2021-3749
• Inefficient Regular Expression Complexity in handsontable - CVE-2021-23446
• string-kit Inefficient Regular Expression Complexity vulnerability - CVE-2021-4299
• Inefficient Regular Expression Complexity in nth-check - CVE-2021-3803

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

ansi-regex