Regular Expression Denial of Service (ReDoS) in jsx-slack
jsx-slack v4.5.1 and earlier versions are vulnerable to a regular expression denial-of-service (ReDoS) attack.
Impact
If attacker can put a lot of JSX elements into <blockquote> tag, an internal regular expression for escaping characters may consume an excessive amount of computing resources.
/** @jsxImportSource jsx-slack */
import { Section } from 'jsx-slack'
console.log(
<Section>
<blockquote>
{[...Array(40)].map((_, i) => (
<p>{i + 1}</p>
))}
</blockquote>
</Section>
)Patches
See also: https://github.com/yhatt/jsx-slack/security/advisories/GHSA-hp68-xhvj-x6j6
jsx-slack v4.5.2 has updated regular expressions to prevent catastrophic backtracking.
jsx-slack v4.5.1 also had patched a workaround. It has no problems to contents with ASCII characters, but still vulnerable to contents with multibyte characters. (https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d)
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-43838
- https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d
Credits
Thanks to @hieki for finding out this vulnerability.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | jsx-slack | < 4.5.1 | 4.5.1 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L- Weakness (CWE)
CWE-1333, CWE-400- Platform
- npm
- Package
jsx-slack- Disclosed
- 17.12.2021
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-55xv-f85c-248q - CC BY 4.0
Vulnerability history: jsx-slack
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 12.2021 01.2022
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 1
- Low 1
Disclosures per year
- 2021: 1
- 2022: 1
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
Regular Expression Denial of Service (ReDoS) in jsx-slack this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.