CVE-2021-3801: prismjs Regular Expression Denial of Service vulnerability
Summary
CVE-2021-3801: prismjs Regular Expression Denial of Service vulnerability. Affects prismjs versions < 1.25.0. Fixed in 1.25.0. How to fix ↓
Also tracked for
- node-prismjs · Debian:11
The same CVE-2021-3801 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Prism is a syntax highlighting library used for displaying formatted code on web pages. It provides support for various programming languages and markup formats. The prismjs package, an npm package, is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability. This type of vulnerability allows an attacker to exploit the package by providing a specially crafted HTML comment as input, leading to excessive CPU consumption in the application.
Vulnerability Detail
The vulnerability in prismjs arises from a regular expression pattern that can be abused to cause a denial of service attack. By providing a malicious HTML comment, an attacker can trigger the regular expression engine to enter into an inefficient matching state, resulting in a significant increase in CPU usage. This can lead to performance degradation or even complete unresponsiveness of the affected application. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: 1.30.0 as of 23 Oct 2026
npm install prismjs@1.30.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.25.0
This is the first release that contains the fix.
npm install prismjs@1.25.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can sanitize user input by validating and limiting the length of HTML comments before passing them to the prismjs library. This can help mitigate the risk of a ReDoS attack. Here's an example of how to sanitize HTML comments in JavaScript:
function sanitizeHTMLComment(comment) {
const maxLength = 100;
if (comment.length > maxLength) {
return '';
}
return comment;
}
Conclusion
The prismjs package is vulnerable to a ReDoS vulnerability that can be exploited by providing a crafted HTML comment as input. This can lead to excessive CPU consumption and impact the performance of the affected application. It is recommended to update the package to version 1.25.0 or later to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for prismjs →
FAQ
Prism is a syntax highlighting library used for displaying formatted code on web pages. It supports various programming languages and markup formats.
A ReDoS vulnerability occurs when a regular expression pattern can be exploited to cause excessive CPU usage, leading to performance degradation or denial of service.
By providing a specially crafted HTML comment as input, an attacker can trigger the vulnerable regular expression pattern in prismjs, causing excessive CPU consumption.
The vulnerability can result in performance degradation or unresponsiveness of the affected application, impacting user experience and potentially leading to service disruption.
To fix the vulnerability, update the prismjs package to version 1.25.0 or later using the command 'npm install prismjs@latest'.
Related vulnerabilities
Recent vulnerabilities recorded for prismjs.
