Inefficient Regular Expression Complexity in node-prismjs - CVE-2021-3801
Summary
CVE-2021-3801: prism is vulnerable to Inefficient Regular Expression Complexity. Affects node-prismjs across 2 version ranges.
< 0ff371bb4775a131634f47d0fe85794c547232f9
< 1.23.0+dfsg-1+deb11u1
Fixed in 1.23.0+dfsg-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-prismjs is a popular syntax highlighting library used in web applications to enhance code readability. It supports a wide range of programming languages and is widely integrated into various projects. However, it is vulnerable to an inefficient regular expression complexity issue, which can lead to performance degradation and potential denial of service in applications utilizing this library.
Vulnerability Detail
CVE-2021-3801 is a vulnerability in node-prismjs that arises from inefficient regular expression patterns. This vulnerability can be exploited by attackers to create specially crafted inputs that cause excessive backtracking in the regex engine, leading to significant performance issues. If exploited, it can result in application slowdowns or crashes, affecting user experience and system stability. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.23.0+dfsg-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-prismjsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to sanitize user inputs before processing them with the affected library. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
CVE-2021-3801 presents a significant risk to applications using the node-prismjs package due to inefficient regular expression complexity. It is crucial for developers to update to the latest versions to mitigate this vulnerability and ensure optimal application performance.
See every vulnerability recorded for node-prismjs →
FAQ
CVE-2021-3801 is a vulnerability in the node-prismjs package that allows for inefficient regular expression processing, potentially leading to performance issues.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to application slowdowns or crashes, impacting user experience and system performance.
The CVSS score for CVE-2021-3801 is 6.5, indicating a moderate severity level.
You can update the package using the command: sudo apt-get install node-prismjs=1.25.0+dfsg-1 for Debian 12 and 13.
Related vulnerabilities
Recent vulnerabilities recorded for node-prismjs.
