Inefficient Regular Expression Complexity in chalk/ansi-regex

The core of the vulnerability lies in the inefficient regular expression complexity within ansi-regex. Attackers can exploit this by crafting malicious ANSI escape code strings containing repetitive patterns. When ansi-regex attempts to parse these strings, the regular expression engine enters a state of exponential backtracking, consuming significant CPU resources. This can lead to the Node.js process becoming unresponsive or crashing entirely, effectively denying service to legitimate users. The impact is particularly severe in applications that heavily rely on parsing ANSI escape codes, such as terminal emulators, logging tools, or command-line interfaces. The provided proof-of-concept demonstrates how a relatively short malicious string can trigger prolonged processing times, highlighting the potential for widespread disruption.

Applications and services built on Node.js that utilize the ansi-regex package are at risk. This includes command-line tools, terminal emulators, logging utilities, and any application that processes ANSI escape codes. Specifically, projects using older versions of ansi-regex and those that do not perform input validation on ANSI escape code strings are particularly vulnerable.

• nodejs / server:

  ps aux | grep ansi-regex | grep -v grep | awk '{print $2}' | xargs -n 1 pmap -x | grep -q 'ansi-regex.js'

• nodejs / server:

  journalctl -u node | grep -i "ansi-regex"

• generic web: Inspect Node.js application logs for unusually high CPU usage or errors related to ansi-regex parsing.

1. 2021-09-20Disclosure

   disclosure

2. 2021-09-20PoC

   poc

3. 2021-09-20Patch

   patch

1. Réservé2021-09-16
2. Publiée2021-09-20
3. Modifiée2026-02-04
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2021-3807 is to upgrade to version 6.0.1 or later of the ansi-regex package. This version includes a fix that addresses the inefficient regular expression complexity. If upgrading is not immediately feasible, consider implementing input validation to sanitize ANSI escape code strings before passing them to ansi-regex. This could involve limiting the length of the strings or filtering out suspicious patterns. Additionally, consider using a Web Application Firewall (WAF) or proxy that can detect and block requests containing potentially malicious ANSI escape codes. After upgrading, confirm the fix by attempting to parse a known malicious ANSI escape code string and verifying that CPU usage remains within acceptable limits.

Dernière mise à jour

6.2.2il y a 8 mois