CVE-2021-27290: Regular Expression Denial of Service (ReDoS) in ssri
Summary
CVE-2021-27290: Regular Expression Denial of Service (ReDoS). Affects ssri across 3 version ranges.
>= 5.2.2, < 6.0.2
>= 7.0.0, < 7.1.1
>= 8.0.0, < 8.0.1
Fixed in 6.0.2, 7.1.1 or 8.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- nodejs · Alpine:v3.13
The same CVE-2021-27290 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ssri is an npm package used for processing Subresource Integrity (SRI) hashes. It provides functions to parse and manipulate SRIs. SRI is a security feature that allows browsers to verify the integrity of resources such as scripts and stylesheets. The ssri package is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. This vulnerability affects versions 5.2.2-6.0.1 and 7.0.0-8.0.0 of the package when the strict option is enabled.
Vulnerability Detail
The vulnerability in ssri arises from the way it processes SRIs using a regular expression. Malicious SRIs can be crafted to trigger a ReDoS attack, causing the processing to take an extremely long time and potentially leading to denial of service. This issue can be exploited by an attacker to disrupt the functioning of systems that rely on ssri for SRI validation. It is important to note that this vulnerability only affects consumers using the strict option.
How To Fix
Latest published version: 14.0.0 as of 22 Oct 2026
npm install ssri@14.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.2.2, < 6.0.26.0.2npm install ssri@6.0.2 -
>= 7.0.0, < 7.1.17.1.1npm install ssri@7.1.1 -
>= 8.0.0, < 8.0.18.0.1npm install ssri@8.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately possible, a workaround is to disable the strict option when using the ssri package. This can be done by setting the 'strict' flag to false in the options passed to the ssri.parse() function. However, disabling the strict option may reduce the effectiveness of SRI validation and should only be considered as a temporary measure until the package can be updated.
Conclusion
The ssri package is vulnerable to a Regular Expression Denial of Service (ReDoS) attack when processing SRIs with the strict option enabled. This can lead to denial of service and disruption of systems relying on ssri for SRI validation. It is recommended to upgrade to a fixed version of the package (6.0.2, 7.1.1, or 8.0.1) to mitigate the vulnerability. If immediate upgrade is not possible, disabling the strict option can serve as a temporary workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ssri →
FAQ
ssri is an npm package used for processing Subresource Integrity (SRI) hashes. It provides functions to parse and manipulate SRIs.
Subresource Integrity (SRI) is a security feature that allows browsers to verify the integrity of resources such as scripts and stylesheets. It uses cryptographic hashes to ensure that the resource has not been tampered with.
The vulnerability in ssri can be exploited by an attacker to trigger a denial of service by causing the processing of malicious SRIs to take an extremely long time. This can disrupt the functioning of systems that rely on ssri for SRI validation.
Versions 5.2.2-6.0.1 and 7.0.0-8.0.0 of the ssri package are affected by this vulnerability when the strict option is enabled.
To fix the vulnerability, upgrade to a fixed version of the ssri package (6.0.2, 7.1.1, or 8.0.1). Update the package version in your project's package.json file and run the package manager to install the updated version.
References
Related vulnerabilities
Recent vulnerabilities recorded for ssri.
