Inefficient Regular Expression Complexity in handsontable

HIGH 7.5CVE-2021-23446 · GHSA-hf66-r44g-p7j9 · Published 29/09/2021 · updated 17/06/2026

In short

CVE-2021-23446 is a HIGH (CVSS 7.5) vulnerability affecting handsontable (handsontable), handsontable.
Chance of exploitation in the next 30 days (EPSS): 3.0%, higher than 87.3% of all vulnerabilities.
Fix: update to 10.0.0 or later.

Package	Affected versions	Patched versions
handsontable handsontable	`< 10.0.0`	`10.0.0`
handsontable npm	`< 10.0.0`	`10.0.0`

Description

The package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in Handsontable.helper.isNumeric function.

NVD description

The package handsontable before 10.0.0; the package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in Handsontable.helper.isNumeric function.

References

nvd.nist.gov/vuln/detail/CVE-2021-23446 · ADVISORY
handsontable/handsontable · WEB
handsontable/handsontable#8742 · WEB
handsontable/handsontable · PACKAGE
snyk.io/vuln/SNYK-DOTNET-HANDSONTABLE-1726793 · WEB
snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1726795 · WEB
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1726796 · WEB
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBHANDSONTABLE-1726794 · WEB
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1726797 · WEB
snyk.io/vuln/SNYK-JS-HANDSONTABLE-1726770 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free