CVE-2021-23364

CVE-2021-23364 · Regular Expression Denial of Service (ReDoS)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

CVSS 5.3 · Medium · EPSS 2.4% · Fix available

Stack: system · node

Affected products and versions

browserslist
Versions
- ≥ 4.0.0, < unspecified: Affected (custom)
- ≥ unspecified, < 4.16.5: Affected (custom)
Update to 4.16.5
node-browserslist Debian:12
Affected ranges
- ECOSYSTEM: < 4.16.3+~cs5.4.72-2
Update to 4.16.3+~cs5.4.72-2
node-browserslist Debian:13
Affected ranges
- ECOSYSTEM: < 4.16.3+~cs5.4.72-2
Update to 4.16.3+~cs5.4.72-2
node-browserslist Debian:14
Affected ranges
- ECOSYSTEM: < 4.16.3+~cs5.4.72-2
Update to 4.16.3+~cs5.4.72-2
browserslist npm
Affected ranges
- SEMVER: ≥ 4.0.0, < 4.16.5
Update to 4.16.5
node-browserslist Ubuntu:18.04:LTS
Versions
- 2.11.3-1
- 2.11.3-1build3
- 2.11.3-1build4
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-browserslist Ubuntu:20.04:LTS
Versions
- 2.11.3-1build4
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-browserslist Ubuntu:22.04:LTS
Versions
- 4.16.3+~cs5.4.72-3
- 4.17.0+~cs5.6.76-1
- 4.18.1+~cs5.1.2-1
- 4.19.1+~cs5.1.2-1
- 4.19.1+repack+~cs5.1.2-2
- 4.19.3+~cs5.1.3-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published