CVE-2021-3803: Inefficient Regular Expression Complexity in nth-check
Summary
CVE-2021-3803: Inefficient Regular Expression Complexity in nth-check. Affects nth-check versions < 2.0.1. Fixed in 2.0.1. How to fix ↓
Also tracked for
- node-nth-check · Debian:11
The same CVE-2021-3803 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nth-check package is an npm package used for parsing and evaluating CSS nth-child expressions. It provides a function called nth-check.parse that is responsible for parsing the expressions. This vulnerability affects versions 0.0.1 to 2.0.0 of the package.
Vulnerability Detail
The vulnerability in nth-check is due to inefficient regular expression complexity. This can lead to a denial-of-service (DoS) attack where an attacker can provide a specially crafted input that causes the regular expression matching to take an excessive amount of time, resulting in a significant performance impact. The affected function is nth-check.parse.
How To Fix
Latest published version: 3.0.1 as of 22 Oct 2026
npm install nth-check@3.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.1
This is the first release that contains the fix.
npm install nth-check@2.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of the nth-check package.
Conclusion
In summary, the nth-check package is vulnerable to an inefficient regular expression complexity issue that can be exploited for a denial-of-service attack. To fix this vulnerability, it is recommended to update to version 2.0.1 or later of the package. There is no known workaround for this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nth-check →
FAQ
This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) attack, resulting in a significant performance impact.
Yes, updating the nth-check package to version 2.0.1 or later will fix this vulnerability.
No, only versions 0.0.1 to 2.0.0 are affected. Version 2.0.1 and later include a fix for this vulnerability.
No, there is no known workaround. It is recommended to update to the latest version of the nth-check package.
You can find more information about this vulnerability in the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-rp65-9cf3-cjxr/GHSA-rp65-9cf3-cjxr.json
