{"id":"CVE-2021-23346","aliases":["EUVD-2021-0605","GHSA-545q-3fg6-48m7"],"status":"published","title":"Regular Expression Denial of Service (ReDoS)","description":"This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used for parsing to backtrack, freezing the process.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:R","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.02129,"percentile":0.82196,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2021-03-04T16:55:21Z","modified":"2026-10-20T10:54:32Z","fixes":[{"ecosystem":"npm","package":"html-parse-stringify","fixed_in":["2.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"html-parse-stringify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"html-parse-stringify2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.1"}]}]},{"source":"osv","ecosystem":"npm","package":"html-parse-stringify","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.1"}]}]},{"source":"osv","ecosystem":"npm","package":"html-parse-stringify2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2.0.1"}]}]}],"products":[{"vendor":"html-parse-stringify_project","product":"html-parse-stringify"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-HTMLPARSESTRINGIFY-1079306","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web"]},{"url":"https://snyk.io/vuln/SNYK-JS-HTMLPARSESTRINGIFY2-1079307","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1080633","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/rayd/html-parse-stringify2/blob/master/lib/parse.js%23L2","tags":["x_refsource_MISC","x_transferred","Broken Link","Third Party Advisory","advisory","web"]},{"url":"https://github.com/HenrikJoreteg/html-parse-stringify/blob/master/lib/parse.js%23L2","tags":["x_refsource_MISC","x_transferred","Broken Link","Third Party Advisory","advisory","web"]},{"url":"https://github.com/HenrikJoreteg/html-parse-stringify/commit/c7274a48e59c92b2b7e906fedf9065159e73fe12","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23346","tags":["advisory"]},{"url":"https://github.com/HenrikJoreteg/html-parse-stringify/releases/tag/v2.0.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-545q-3fg6-48m7"}],"sources":{"cve":[{"id":"CVE-2021-23346","title":"Regular Expression Denial of Service (ReDoS)","description":"This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used for parsing to backtrack, freezing the process.","status":"published","published":"2021-03-04T16:55:21.677Z","modified":"2024-09-16T17:24:19.05Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:R","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2021-0605","description":"This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used for parsing to backtrack, freezing the process.","status":"published","published":"2021-03-04T16:55:21Z","modified":"2024-09-16T17:24:19Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:R","level":"medium"}],"updated_at":"2026-11-03T00:55:41.925187Z"}],"ghsa":[{"id":"GHSA-545q-3fg6-48m7","title":"html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS)","description":"This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used for parsing to backtrack, freezing the process.","status":"published","published":"2021-03-18T19:39:31Z","modified":"2023-09-12T20:51:15Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:05.004935Z"}],"nvd":[{"id":"CVE-2021-23346","description":"This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used for parsing to backtrack, freezing the process.","status":"published","published":"2021-03-04T17:15:13.7Z","modified":"2026-06-17T03:38:35.853Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:50.399901Z"}],"osv":[{"id":"CVE-2021-23346","description":"This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used for parsing to backtrack, freezing the process.","status":"published","published":"2021-03-04T17:15:13.7Z","modified":"2026-10-20T10:54:32.804648021Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"GHSA-545q-3fg6-48m7","title":"html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS)","description":"This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used for parsing to backtrack, freezing the process.","status":"published","published":"2021-03-18T19:39:31Z","modified":"2025-01-14T08:56:53.391305Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:37.864461Z"}]}}