How severe is CVE-2021-43843?

CVE-2021-43843 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2021-43843 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (77th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-43843?

CVE-2021-43843 affects Jsx-slack Project Jsx-slack. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-43843?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-43843 published?

CVE-2021-43843 was published on 2021-12-20 and last updated on 2026-06-17.

CVE-2021-43843

CVE-2021-43843 is a medium-severity vulnerability in Jsx-slack Project Jsx-slack with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-400.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v2: 5.0
EPSS exploit prediction: 2% (77th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-400
Affected product: Jsx-slack Project Jsx-slack
Published: 2021-12-20
Last modified: 2026-06-17

Description

jsx-slack is a package for building JSON objects for Slack block kit surfaces from JSX. The maintainers found the patch for CVE-2021-43838 in jsx-slack v4.5.1 is insufficient tfor protection from a Regular Expression Denial of Service (ReDoS) attack. If an attacker can put a lot of JSX elements into `<blockquote>` tag _with including multibyte characters_, an internal regular expression for escaping characters may consume an excessive amount of computing resources. v4.5.1 passes the test against ASCII characters but misses the case of multibyte characters. jsx-slack v4.5.2 has updated regular expressions for escaping blockquote characters to prevent catastrophic backtracking. It is also including an updated test case to confirm rendering multiple tags in `<blockquote>` with multibyte characters.

Frequently asked questions

What is CVE-2021-43843?: jsx-slack is a package for building JSON objects for Slack block kit surfaces from JSX. The maintainers found the patch for CVE-2021-43838 in jsx-slack v4.5.1 is insufficient tfor protection from a Regular Expression Denial of Service (ReDoS) attack. If an attacker can put a lot of JSX elements into `<blockquote>` tag _with including multibyte characters_, an internal regular expression for escaping characters may consume an excessive amount of computing resources. v4.5.1 passes the test against ASCII characters but misses the case of multibyte characters. jsx-slack v4.5.2 has updated regular expressions for escaping blockquote characters to prevent catastrophic backtracking. It is also including an updated test case to confirm rendering multiple tags in `<blockquote>` with multibyte characters.
How severe is CVE-2021-43843?: CVE-2021-43843 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2021-43843 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (77th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-43843?: CVE-2021-43843 affects Jsx-slack Project Jsx-slack. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-43843?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-43843 published?: CVE-2021-43843 was published on 2021-12-20 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:jsx-slack_project:jsx-slack:*:*:*:*:*:node.js:*:*

More vulnerabilities in Jsx-slack Project Jsx-slack

CVE-2021-43838 — Medium (CVSS 5.3): jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. In versions prior to 4.5.1…

All CVEs affecting Jsx-slack Project Jsx-slack →

Other CWE-400 (Uncontrolled Resource Consumption) vulnerabilities

CVE-2026-46775 — Critical (CVSS 9.9): Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0.…
CVE-2025-61303 — Critical (CVSS 9.8): Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a…
CVE-2025-43193 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7,…
CVE-2025-24269 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to…
CVE-2025-24264 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4,…
CVE-2025-24260 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5,…

Browse all CWE-400 (Uncontrolled Resource Consumption) vulnerabilities →