CVE-2021-43838: Jsx-Slack Project Jsx-Slack

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. In versions prior to 4.5.1 users are vulnerable to a regular expression denial-of-service (ReDoS) attack. If attacker can put a lot of JSX elements into `<blockquote>` tag, an internal regular expression for escaping characters may consume an excessive amount of computing resources. jsx-slack v4.5.1 has patched to a regex for escaping blockquote characters. Users are advised to upgrade as soon as possible.

Affected products

• Jsx-Slack Project Jsx-Slack: before 4.5.2 (fixed in 4.5.2)

Published 2021-12-17. Last modified 2026-06-17.