AIKIDO-2026-456719
highlight.js is vulnerable to Regular Expression Denial of Service (ReDoS)
53
Medium Risk
This Affects:
highlight.jsTL;DR
The C, C++, and Arduino grammars build the function-declaration matcher from a nested unbounded quantifier of the form (type-token [*&\s]+)+ placed before a function name. When highlighting source that contains a long run of whitespace-separated words that never resolves to a function title, the regex engine explores many ways to split that run and backtracks quadratically in the size of the input. Processing crafted content can pin the highlighting thread at high CPU and stall the host, producing a denial of service. The fix bounds the run of leading type tokens to a fixed maximum so the matcher can no longer backtrack quadratically.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you highlight user-controlled C, C++, or Arduino source, either directly or through highlightAuto.
Background info
highlight.js is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 8.4.0 - 11.11.2.
How to fix this
Upgrade the highlight.js library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant