CVE-2021-23382
CVE-2021-23382 · Regular Expression Denial of Service (ReDoS)
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).
CVSS 5.3 · Medium · EPSS 2.6% · Fix available
- Published
- Updated
Affected products and versions
postcss
- Versions
- ≥ unspecified, < 8.2.13: Affected (custom)
Update to 8.2.13
node-postcss Debian:12
- Affected ranges
- ECOSYSTEM: < 8.2.1+~cs5.3.23-7
Update to 8.2.1+~cs5.3.23-7
node-postcss Debian:13
- Affected ranges
- ECOSYSTEM: < 8.2.1+~cs5.3.23-7
Update to 8.2.1+~cs5.3.23-7
node-postcss Debian:14
- Affected ranges
- ECOSYSTEM: < 8.2.1+~cs5.3.23-7
Update to 8.2.1+~cs5.3.23-7
postcss npm
- Affected ranges
- SEMVER: ≥ 8.0.0, < 8.2.13
Update to 8.2.13
postcss npm
- Affected ranges
- SEMVER: < 7.0.36
Update to 7.0.36
node-postcss Ubuntu:20.04:LTS
- Versions
- 6.0.23-1
- 6.0.23-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-postcss Ubuntu:22.04:LTS
- Versions
- 8.2.1+~cs5.3.23-8
- 8.4.5+~cs7.1.51-2
- 8.4.6+~cs7.3.21-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published