Regular Expression Denial of Service in postcss
moderate severity
Published
May 10, 2021
•
Updated Jun 15, 2021
Package
postcss
(npm)
Affected versions
>= 7.0.0, < 7.0.36
>= 8.0.0, < 8.2.10
Patched versions
7.0.36
8.2.10
Description
CVE ID
CVE-2021-23368
CWEs
CVSS Score
5.3 Moderate
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
The npm package
postcssfrom 7.0.0 and before versions 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.References