CVE-2021-43843

jsx-slack is a package for building JSON objects for Slack block kit surfaces from JSX. The maintainers found the patch for CVE-2021-43838 in jsx-slack v4.5.1 is insufficient tfor protection from a Regular Expression Denial of Service (ReDoS) attack. If an attacker can put a lot of JSX elements into `<blockquote>` tag _with including multibyte characters_, an internal regular expression for escaping characters may consume an excessive amount of computing resources. v4.5.1 passes the test against ASCII characters but misses the case of multibyte characters. jsx-slack v4.5.2 has updated regular expressions for escaping blockquote characters to prevent catastrophic backtracking. It is also including an updated test case to confirm rendering multiple tags in `<blockquote>` with multibyte characters.

• CWE-400
• CWE-1333

• https://github.com/yhatt/jsx-slack/commit/46bc88391d89d5fda4ce689e18ca080bcdd29eccPatch, Third Party Advisory
• https://github.com/yhatt/jsx-slack/releases/tag/v4.5.2Release Notes, Third Party Advisory
• https://github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f85c-248qExploit, Patch, Third Party Advisory
• https://github.com/yhatt/jsx-slack/security/advisories/GHSA-hp68-xhvj-x6j6Exploit, Patch, Third Party Advisory
• https://github.com/yhatt/jsx-slack/commit/46bc88391d89d5fda4ce689e18ca080bcdd29eccPatch, Third Party Advisory
• https://github.com/yhatt/jsx-slack/releases/tag/v4.5.2Release Notes, Third Party Advisory
• https://github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f85c-248qExploit, Patch, Third Party Advisory
• https://github.com/yhatt/jsx-slack/security/advisories/GHSA-hp68-xhvj-x6j6Exploit, Patch, Third Party Advisory

Published

Dec 20, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43838jsx-slack is a library for building JSON objects for Slack B…7.5
• CVE-2021-43839Cronos is a commercial implementation of a blockchain. In Cr…7.5
• CVE-2021-4384The WordPress Photo Gallery – Image Gallery plugin for WordP…4.3
• CVE-2021-43840message_bus is a messaging bus for Ruby processes and web cl…6.5
• CVE-2021-43841XWiki is a generic wiki platform offering runtime services f…5.4
• CVE-2021-43842Wiki.js is a wiki app built on Node.js. Wiki.js versions 2.5…5.4
• CVE-2021-43844MSEdgeRedirect is a tool to redirect news, search, widgets, …8.8
• CVE-2021-43845PJSIP is a free and open source multimedia communication lib…9.1
• CVE-2021-43846`solidus_frontend` is the cart and storefront for the Solidu…4.3
• CVE-2021-43847HumHub is an open-source social network kit written in PHP. …6.5
• CVE-2021-43848h2o is an open source http server. In code prior to the `8c0…5.9
• CVE-2021-43849cordova-plugin-fingerprint-aio is a plugin provides a single…5.5