LiveActive security incident?Get immediate response
CVE Record

CVE-2021-23424: Regular Expression Denial of Service (ReDoS)

This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

ansi-html can be forced to spend excessive processing time on malicious text. If attacker-controlled input reaches this library, the business risk is service slowdown or outage, not data theft. The supplied bundle does not show CISA KEV listing or confirmed active exploitation.

Executive priority

Treat as high priority for exposed services because successful abuse can reduce availability without authentication. It is less urgent where ansi-html is only used on trusted build-time data. Validate reachability before emergency action.

Technical view

CVE-2021-23424 is a Regular Expression Denial of Service issue in the npm package ansi-html. The source bundle states all versions are affected and malicious input can make processing run for an extremely long time. CVSS 3.1 is 7.5, with availability impact only.

Likely exposure

Exposure is most likely in JavaScript applications, build pipelines, or dependencies that use ansi-html on untrusted or semi-trusted text. The bundle also cites a WebJars npm advisory. No specific downstream product exposure is proven in the provided sources.

Exploitation context

The provided CVSS vector indicates network-reachable, low-complexity, unauthenticated denial of service potential. KEV is false, so active exploitation is not established from the bundle. Evidence supports possible exploitation through malicious input but not widespread abuse.

Researcher notes

The source bundle names ansi-html broadly as affected and does not provide a fixed version. Keep findings scoped to ReDoS availability impact. Do not infer confidentiality, integrity, or active exploitation beyond the cited advisories and KEV=false signal.

Mitigation direction

  • Inventory direct and transitive ansi-html dependencies across application and build manifests.
  • Check vendor and advisory guidance for replacement, removal, or upgrade direction.
  • Avoid passing attacker-controlled input to ansi-html where practical.
  • Apply input size limits and request timeouts around affected processing paths.
  • Prioritize internet-facing services that process user-supplied text.

Validation and detection

  • Confirm whether ansi-html appears in production dependency trees or packaged assets.
  • Map call paths where external input reaches ANSI-to-HTML conversion.
  • Review runtime telemetry for CPU spikes tied to text-processing endpoints.
  • Verify compensating controls such as input limits and timeout handling.
  • Track advisory sources for any newly published fixed version or migration guidance.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-23424 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P3.93.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2021-23424Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aansi-html0Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.