CVE-2021-23424

What it actually does

CVE-2021-23424 is a denial-of-service flaw in the npm package ansi-html. The package can enter extremely long processing when handling attacker-controlled strings, likely due to inefficient parsing of crafted ANSI escape sequences. Any application, service, build tool, logging pipeline, web endpoint, or API that passes untrusted input into ansi-html can have its Node.js process tied up, causing event-loop blocking, high CPU utilization, request timeouts, degraded throughput, or process termination. The vulnerability is remotely reachable when the vulnerable parsing path is exposed through network-accessible input, and it requires no authentication or user interaction according to the supplied CVSS vector.

Why it matters to the business

Successful exploitation can make affected services slow or unavailable, disrupting customer-facing applications, internal developer tooling, log viewers, dashboards, or APIs that render ANSI-colored text. Because the affected package is a reusable dependency, exposure may be indirect through downstream packages rather than direct application code. The vulnerability has public exploit availability, so remediation should be prioritized for systems that process user-supplied text, logs, terminal output, CI/CD output, chat messages, support tickets, or other free-form strings. No CISA KEV listing or ransomware association is currently indicated, and the EPSS score is relatively low, but availability impact is high where the vulnerable code path is reachable.

How an attack unfolds

An attacker first identifies a feature that accepts arbitrary text and causes the application to convert ANSI-formatted content to HTML using ansi-html. They then submit a specially crafted string containing ANSI escape-like content or malformed control-sequence patterns that trigger pathological processing inside the library. When the vulnerable function attempts to parse or transform the string, the Node.js process spends an excessive amount of time handling the payload. Because Node.js applications often rely on a single event loop per process, one expensive parse operation can delay other requests, increase latency, exhaust worker capacity, and cause health checks or upstream proxies to mark the service unhealthy. Repeated requests can sustain the outage or amplify it across multiple application instances.

How to fix it

There is no fixed version provided for ansi-html in the supplied data. Treat the package as unsafe for untrusted input unless a maintained patched fork or replacement has been adopted. Recommended remediation is to remove ansi-html where possible, replace it with a maintained alternative such as a vetted ANSI-to-HTML renderer, or use a patched community-maintained fork after confirming it is not affected by the same parsing weakness. If immediate replacement is not feasible, mitigate by preventing untrusted data from reaching ansi-html, enforcing strict maximum input lengths, rejecting or normalizing ANSI escape sequences before parsing, applying request body and field-size limits, rate-limiting endpoints that reach the vulnerable path, and isolating rendering work in bounded worker processes with execution timeouts. Rebuild and redeploy all applications after dependency changes, and ensure lockfiles and transitive dependencies no longer resolve to the vulnerable package.

How to confirm the fix worked

Confirm exposure by reviewing package manifests and lockfiles for ansi-html, including transitive dependency paths. Run dependency scanners such as npm audit, SCA tooling, or software composition analysis across source repositories, containers, and deployed artifacts. Validate remediation by confirming the vulnerable package is removed or replaced in package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, container layers, and production bundles. Exercise the previously reachable input paths with benign long strings and ANSI escape sequences to ensure request latency remains bounded, the process does not spike CPU, and event-loop lag remains acceptable. Confirm that input-size limits, request timeouts, rate limits, and worker isolation controls are active. For production validation, monitor application latency, 5xx responses, Node.js event-loop lag, CPU saturation, restart counts, and timeout metrics after deployment.

Typical attack path

1. Find a network-accessible input field, API parameter, uploaded text artifact, log ingestion path, CI output viewer, chat/comment field, or terminal-output renderer that accepts attacker-controlled strings.
2. Confirm or infer that the application renders ANSI-formatted text to HTML using the vulnerable ansi-html package, directly or through a dependent component.
3. Send a crafted string containing malicious or malformed ANSI escape-sequence content designed to cause excessive processing.
4. Cause the Node.js process to block, consume CPU, stall the event loop, or exceed request/worker timeouts while ansi-html processes the input.
5. Repeat or parallelize requests to keep the service degraded or unavailable.

How to detect it

Look for signs of resource-exhaustion activity rather than a reliable file-drop or persistence artifact, because this is a denial-of-service vulnerability. Useful sources include web access logs, API gateway logs, reverse proxy logs, WAF logs, application logs, Node.js process metrics, APM traces, container orchestration events, and host CPU telemetry. Search for requests containing ANSI escape-sequence patterns, unusually long text fields, repeated malformed terminal color codes, or encoded escape characters such as %1B, \u001b, or \x1b. Correlate those requests with spikes in CPU usage, increased Node.js event-loop lag, request timeouts, elevated 502/503/504 responses, container restarts, failed liveness probes, or worker process recycling. For forensic review, identify whether affected endpoints invoked ANSI-to-HTML rendering immediately before latency or availability incidents. Since no KEV or named threat actor activity is indicated, focus detection on behavioral evidence: anomalous payloads plus service degradation.

• node_modules/ansi-html
• "ansi-html"
• ansi-html
• \u001b[
• \x1b[
• %1B%5B
• %1b%5b
• ESC[
• \033[
• \e[
• HTTP 502
• HTTP 503
• HTTP 504
• ETIMEDOUT
• Request timeout
• event loop lag
• JavaScript heap out of memory
• Allocation failed - JavaScript heap out of memory

What your security team should do

• Inventory all applications, containers, build systems, developer portals, log viewers, and web services that include the ansi-html package directly or transitively.
• Prioritize remediation for internet-facing or multi-tenant services that process untrusted text, logs, terminal output, CI/CD output, comments, messages, or uploaded artifacts.
• Remove or replace ansi-html because no fixed version was supplied; verify lockfiles and production artifacts no longer include the vulnerable dependency.
• Add input validation and maximum length limits before any ANSI-to-HTML rendering path, especially for unauthenticated endpoints.
• Add rate limiting and request timeouts around routes that process free-form text or render ANSI output.
• Monitor for exploitation attempts by looking for bursts of requests containing ANSI escape sequences followed by high CPU, event-loop lag, request timeouts, or service restarts.
• Create regression tests using long and malformed ANSI-like strings to ensure rendering remains bounded after remediation.
• If replacement cannot be completed quickly, isolate rendering in separate workers or sandboxes with strict CPU, memory, and wall-clock time limits.