# CVE-2021-3810: code-server regular expression denial of service

Source: https://junglewise.ai/threats/cve-2021-3810-code-server-regular-expression-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-09-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-3810 · Severity: low · CVSS 3 · Published 2021-09-20

code-server is a browser-based code editor that allows developers to access VS Code remotely. The application uses a regular expression to parse terminal color codes, but this regex is susceptible to denial-of-service attacks through specially crafted input. An attacker can send malicious data that causes the regex engine to consume excessive CPU resources, freezing or crashing the service and preventing legitimate users from accessing their development environment.

Technologies: [code-server (npm)](https://junglewise.ai/threats/technologies/code-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-3810 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-3810 being exploited in the wild.

**How severe is CVE-2021-3810?** Low severity, with a CVSS score of 3, published 20 September 2021.

**Which products and versions are affected?** code-server (npm) SEMVER:introduced=0,fixed=3.12.0.

**Is there a fix for CVE-2021-3810?** Yes. code-server (npm): upgrade to 3.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-3810 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2021-3810?** Check whether you run code-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- code-server (npm): upgrade to 3.12.0 or later

  ```sh
  npm install code-server@3.12.0
  ```


## Technical details

code-server contains a ReDoS (Regular Expression Denial of Service) vulnerability in an ANSI escape code parsing regex located in src/node/util.ts. The vulnerable pattern exhibits catastrophic backtracking when processing specially crafted input, allowing an unauthenticated network attacker to trigger excessive CPU consumption without requiring user interaction. The regex was intended to filter ANSI color codes from terminal output but contained nested quantifiers that could cause exponential matching behavior. The vulnerability was patched in version 3.12.0 by optimizing the regex pattern to avoid backtracking. All prior versions are affected.

## Affected products

- Coder code-server before 3.12.0

## Identifiers

- CVE-2021-3810
- GHSA-49x3-8228-3w3m

## Timeline

- 2021-09-17: disclosed: Published on NVD
- 2021-09-20: advisory: GitHub Security Advisory GHSA-49x3-8228-3w3m published
- 2021-09-20: patched: Fixed in code-server 3.12.0 via commit ca617df

## References

- [https://github.com/cdr/code-server/commit/ca617df135e78833f93c8320cb2d2cf8bba809f5](https://github.com/cdr/code-server/commit/ca617df135e78833f93c8320cb2d2cf8bba809f5)
- [https://github.com/cdr/code-server](https://github.com/cdr/code-server)
- [https://huntr.dev/bounties/38888513-30fc-4d8f-805d-34070d60e223](https://huntr.dev/bounties/38888513-30fc-4d8f-805d-34070d60e223)

## Related threats

- [code-server session cookie extraction via malicious proxy URL](https://junglewise.ai/threats/cve-2025-47269-code-server-session-cookie-extraction-via-malicious-proxy-url)
- [Coder code-server missing origin validation in WebSocket](https://junglewise.ai/threats/cve-2023-26114-coder-code-server-missing-origin-validation-in-websocket)
- [Coder code-server XSS in error page](https://junglewise.ai/threats/cve-2021-42648-coder-code-server-xss-in-error-page)