Regular Expression Denial of Service in highcharts

HIGH 7.5CVE-2018-20801 · GHSA-xmc8-cjfr-phx3 · Published 14/03/2019 · updated 17/06/2026

In short

CVE-2018-20801 is a HIGH (CVSS 7.5) vulnerability affecting highcharts (highcharts), highcharts.
Chance of exploitation in the next 30 days (EPSS): 3.2%, higher than 88.0% of all vulnerabilities.
Fix: update to 6.1.0 or later.

Package	Affected versions	Patched versions
highcharts highcharts	`< 6.1.0`	`6.1.0`
highcharts npm	`< 6.1.0`	`6.1.0`

Description

Versions of highcharts prior to 6.1.0 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Recommendation

Upgrade to version 6.1.0 or higher.

NVD description

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.

References

nvd.nist.gov/vuln/detail/CVE-2018-20801 · ADVISORY
highcharts/highcharts commit 7c547e1 · WEB
GitHub Advisory GHSA-xmc8-cjfr-phx3 · ADVISORY
highcharts/highcharts · PACKAGE
security.netapp.com/advisory/ntap-20190715-0001 · WEB
snyk.io/vuln/npm:highcharts:20180225 · WEB
npmjs.com/advisories/793 · WEB
security.netapp.com/advisory/ntap-20190715-0001

More vulnerabilities in highcharts

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

highcharts

< 6.1.0

6.1.0

highcharts

npm

< 6.1.0

6.1.0

Description

Recommendation

Upgrade to version 6.1.0 or higher.

NVD description