npm package
ansi-regex vulnerabilities by version
The latest release, 6.4.0 (Sep 27, 2026), has no known vulnerabilities. 2% of last week’s 512.8M downloads went to versions with known vulnerabilities. OSV.dev lists 2 advisories for ansi-regex; the newest was published on Sep 8, 2025.
npm (opens in a new tab) describes it as “Regular expression for matching ANSI escape codes”
- Latest release
- 6.4.0
- Sep 27, 2026, no known vulnerabilities
- Downloads last week
- 512.8M
- All versions, from npm
- Advisories on OSV.dev
- 2
- Newest Sep 8, 2025
- Licence
- MIT
Most-downloaded versions last week
From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.
Who is still on a vulnerable ansi-regex
2% of last week’s 512.8M ansi-regex downloads went to versions with known vulnerabilities.
From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.
Release lines
The newest release of each major line, from the registry. ansi-regex doesn’t publish support dates we can check.
Newest advisories
The 2 most recently published, with the versions each one affects.
WarningGHSA-jvhh-2m83-6w29 on OSV.dev (opens in a new tab)MAL-2025-46966
Malicious code in ansi-regex (npm)
Published Sep 8, 2025.
CriticalCVE-2021-3807 on OSV.dev (opens in a new tab)GHSA-93q8-gq69-wqmw
Inefficient Regular Expression Complexity in chalk/ansi-regex
Affects >= 6.0.0, < 6.0.1; >= 5.0.0, < 5.0.1; >= 4.0.0, < 4.1.1; >= 3.0.0, < 3.0.1. Published Sep 20, 2021.
Which ansi-regex do you have?
Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.
How this page is checked
StackPrism reads every OSV.dev advisory for ansi-regex, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.