Every CVE Search/ Get API key

CVE-2021-3801

Inefficient Regular Expression Complexity in prismjs/prism

7.5 HighFix available

prism is vulnerable to Inefficient Regular Expression Complexity

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.04%Up 0.4 points since Sep 16, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.5

Inefficient Regular Expression Complexity in prismjs/prism

prism is vulnerable to Inefficient Regular Expression Complexity

Record
CVE-2021-3801
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
EUVDEUVD-2021-2075 7.5

prism is vulnerable to Inefficient Regular Expression Complexity

Record
EUVD-2021-2075
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-hqhp-5p83-hx96 6.5

prismjs Regular Expression Denial of Service vulnerability

Prism is a syntax highlighting library. The prismjs package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted HTML comment as input may cause an application to consume an excessive amount of CPU.

Record
GHSA-hqhp-5p83-hx96
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
NVD 6.5

prism is vulnerable to Inefficient Regular Expression Complexity

Record
CVE-2021-3801
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-1333
Updated
2026-11-02
OSV 6.5

prism is vulnerable to Inefficient Regular Expression Complexity

Record
CVE-2021-3801
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-3801 6.5

prism is vulnerable to Inefficient Regular Expression Complexity

Record
DEBIAN-CVE-2021-3801
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-hqhp-5p83-hx96 6.5

prismjs Regular Expression Denial of Service vulnerability

Prism is a syntax highlighting library. The prismjs package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted HTML comment as input may cause an application to consume an excessive amount of CPU.

Record
GHSA-hqhp-5p83-hx96
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVUBUNTU-CVE-2021-3801 6.5

prism is vulnerable to Inefficient Regular Expression Complexity

Record
UBUNTU-CVE-2021-3801
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1793304056 No score

TuxCare security update for prismjs (6 CVEs)

TuxCare rebuilt prismjs to address 6 CVEs. Fixed in 1.17.1-tuxcare.1.

Record
CLSA-2026-1793304056
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
prismjs
npm
 before 1.25.0
1.25.0
prismjs
TuxCare:npm
From an advisory covering 6 CVEs
 1.17.1-tuxcare.0 up to 1.17.1-tuxcare.1, plus listed versions
1.17.1
1.17.1-tuxcare.1
node-prismjs
Debian:12
 before 1.25.0+dfsg-1
1.25.0+dfsg-1
node-prismjs
Debian:13
 before 1.25.0+dfsg-1
1.25.0+dfsg-1
node-prismjs
Debian:14
 before 1.25.0+dfsg-1
1.25.0+dfsg-1
node-prismjs
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.11.0+dfsg-21.11.0+dfsg-3
 None known
node-prismjs
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.23.0+dfsg-11.25.0+dfsg-11.27.0+dfsg+~1.26.0-1
 None known
node-prismjs
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.29.0+dfsg+~1.26.0-1
 None known
node-prismjs
Ubuntu:25.10
 All versions, plus listed versions
1.29.0+dfsg+~1.26.0-11.30.0+dfsg+~1.26.5-1
 None known
node-prismjs
Ubuntu:26.10
 All versions, plus listed versions
1.30.0+dfsg+~1.26.6-1
 None known
node-prismjs
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.30.0+dfsg+~1.26.5-11.30.0+dfsg+~1.26.5-21.30.0+dfsg+~1.26.6-1
 None known

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-3801 is a high vulnerability (CVSS 7.5) in Prismjs Prism, published September 15, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.04%, the 64th percentile. Fixed in prismjs 1.25.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open