CVE-2021-23368

CVE-2021-23368 · Regular Expression Denial of Service (ReDoS)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.

CVSS 5.3 · Medium · EPSS 3.5% · Fix available

Stack: system · node

Affected products and versions

postcss
Versions
- ≥ 7.0.0, < unspecified: Affected (custom)
- ≥ unspecified, < 8.2.10: Affected (custom)
Update to 8.2.10
node-postcss Debian:12
Affected ranges
- ECOSYSTEM: < 8.2.1+~cs5.3.23-6
Update to 8.2.1+~cs5.3.23-6
node-postcss Debian:13
Affected ranges
- ECOSYSTEM: < 8.2.1+~cs5.3.23-6
Update to 8.2.1+~cs5.3.23-6
node-postcss Debian:14
Affected ranges
- ECOSYSTEM: < 8.2.1+~cs5.3.23-6
Update to 8.2.1+~cs5.3.23-6
postcss npm
Affected ranges
- SEMVER: ≥ 7.0.0, < 7.0.36
Update to 7.0.36
postcss npm
Affected ranges
- SEMVER: ≥ 8.0.0, < 8.2.10
Update to 8.2.10
node-postcss Ubuntu:22.04:LTS
Versions
- 8.2.1+~cs5.3.23-8
- 8.4.5+~cs7.1.51-2
- 8.4.6+~cs7.3.21-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published