Fix cross-spawn CVE-2024-21538 — ReDoS Vulnerability | PackageFix

Last updated: April 1, 2026 · Data: OSV Database

Updated April 1, 2026 · HIGH · CVSS 7.5 · Safe version: 7.0.5

cross-spawn has a high-severity ReDoS vulnerability (CVE-2024-21538) affecting all versions below 7.0.5. With 148 million weekly downloads, it is almost always a transitive dependency — you probably have it without knowing. Fix: npm overrides forcing 7.0.5.

CVE-2024-21538 Details

What is the vulnerability?

cross-spawn uses a regular expression to escape arguments when spawning child processes. The regex has catastrophic backtracking behavior — a crafted string with many backslashes followed by a specific Unicode character causes the CPU to spike to 100% and the process to hang indefinitely. This is a classic ReDoS pattern.

The vulnerable code is in cross-spawn/lib/util/escape.js in the argument() function. The fix in 7.0.5 disables regexp backtracking entirely for this case.

Am I affected?

# Check if cross-spawn is in your tree
npm ls cross-spawn

# Check the version specifically
npm ls cross-spawn | grep cross-spawn

# If you see any version below 7.0.5, you are affected

my-app@1.0.0
├── jest@29.7.0
│   └── cross-spawn@7.0.3  <-- VULNERABLE
└── eslint@8.57.0
    └── cross-spawn@7.0.3  <-- VULNERABLE

Fix: npm overrides

cross-spawn is almost always a transitive dependency. The fix is to add an npm override that forces all packages to use the safe version.

// package.json
{
  "dependencies": {
    "jest": "^29.7.0",
    "eslint": "^8.57.0"
  },
  "overrides": {
    "cross-spawn": "7.0.5"
  }
}

# After adding the override, reinstall
npm install

# Verify the fix
npm ls cross-spawn
# All instances should now show 7.0.5

# Confirm npm audit is clean
npm audit

Why cross-spawn is everywhere

cross-spawn solves a real problem: Node.js's built-in child_process.spawn has inconsistent behavior on Windows. Argument escaping works differently, paths with spaces break, and certain characters cause issues. cross-spawn wraps the built-in to provide consistent cross-platform behavior.

This is why virtually every tool that runs CLI commands uses it — jest, eslint, webpack, vite, create-react-app, npm itself. Most Node.js projects have it 5-15 times over at various depths. The 148 million weekly downloads are almost entirely transitive.