CVE-2021-3777: Inefficient Regular Expression Complexity in tmpl
Summary
CVE-2021-3777: tmpl vulnerable to Inefficient Regular Expression Complexity which may lead to resource exhaustion. Affects tmpl versions < 1.0.5. Fixed in 1.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tmpl is a simple string formatting package in the npm ecosystem. It provides a templating mechanism for generating strings by replacing placeholders with corresponding values. tmpl is vulnerable to an Inefficient Regular Expression Complexity issue, which can lead to resource exhaustion.
Vulnerability Detail
The vulnerability in tmpl arises from inefficient regular expressions, which can result in excessive backtracking and cause the application to consume excessive resources. An attacker can exploit this vulnerability by providing specially crafted input that triggers the inefficient regular expression, leading to denial of service or resource exhaustion. The impact of this vulnerability can be severe, potentially disrupting the availability of the affected application.
How To Fix
Latest published version: 1.0.5 as of 22 Oct 2026
npm install tmpl@1.0.5The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the tmpl package to the fixed version to mitigate the risk.
Conclusion
In summary, tmpl is vulnerable to an Inefficient Regular Expression Complexity issue, which can lead to resource exhaustion or denial of service. To mitigate this vulnerability, it is crucial to update the tmpl package to version 1.0.5 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tmpl →
FAQ
tmpl is a simple string formatting package in the npm ecosystem. It provides a templating mechanism for generating strings by replacing placeholders with corresponding values.
The vulnerability can lead to resource exhaustion or denial of service, potentially disrupting the availability of the affected application.
To fix this vulnerability, update the tmpl package to version 1.0.5 or later by running the command: npm install tmpl@1.0.5
There is no known workaround for this vulnerability. It is crucial to update the tmpl package to the fixed version.
For more information about this vulnerability, you can visit the GitHub advisory page: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-jgrx-mgxx-jf9v/GHSA-jgrx-mgxx-jf9v.json
