Regular Expression Denial of Service in highcharts
Summary
GHSA-m45f-4828-5cv5: Regular Expression Denial of Service in highcharts. Affects highcharts versions < 6.1.0. Fixed in 6.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Highcharts is a popular JavaScript charting library used for creating interactive and visually appealing charts on web pages. It provides a wide range of chart types and customization options, making it a versatile tool for data visualization. However, a vulnerability has been discovered in Highcharts that could potentially lead to a Regular Expression Denial of Service (ReDoS) attack.
Vulnerability Detail
The vulnerability in Highcharts is related to the way it handles regular expressions. By providing specially crafted input, an attacker can cause the regular expression engine to enter into an infinite loop, consuming excessive CPU resources and causing a denial of service condition. This can result in degraded performance or even a complete system outage. The vulnerability has a moderate severity rating and affects versions prior to 6.1.0 of the Highcharts npm package.
How To Fix
Latest published version: 13.1.1 as of 23 Oct 2026
npm install highcharts@13.1.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.1.0
This is the first release that contains the fix.
npm install highcharts@6.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately update to the fixed version of Highcharts, you can implement a workaround to mitigate the risk. One possible workaround is to validate and sanitize user input before passing it to the Highcharts library. By ensuring that the input does not contain any malicious or excessively complex regular expressions, you can reduce the likelihood of a successful ReDoS attack.
Conclusion
The Regular Expression Denial of Service vulnerability in Highcharts can be mitigated by updating to version 6.1.0 or higher of the Highcharts npm package. If immediate updating is not possible, implementing input validation and sanitization can help reduce the risk of a successful attack. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for highcharts →
FAQ
Highcharts is a JavaScript charting library used for creating interactive and visually appealing charts on web pages. It offers a wide range of chart types and customization options.
A Regular Expression Denial of Service (ReDoS) attack is a type of denial of service attack that targets regular expression implementations. By providing specially crafted input, an attacker can cause the regular expression engine to enter into an infinite loop, consuming excessive CPU resources and causing a denial of service condition.
This vulnerability has a moderate severity rating.
Versions prior to 6.1.0 of the Highcharts npm package are affected.
You can update the Highcharts npm package to version 6.1.0 or higher by running the command 'npm install highcharts@6.1.0' in your project directory.
References
Related vulnerabilities
Recent vulnerabilities recorded for highcharts.
