CVE-2021-23368: Regular Expression Denial of Service (ReDoS)
A regular expression denial of service (ReDoS) vulnerability was found in the npm library `postcss`. When parsing a supplied CSS string, if it contains an unexpected value then as the supplied CSS grows in length it will take an ever increasing amount of time to process. An attacker can use this vulnerability to potentially craft a malicious a long CSS value to process resulting in a denial of service.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-23368?
CVE-2021-23368 is a vulnerability found in the npm library `postcss` that allows for a regular expression denial of service (ReDoS) attack.
How does CVE-2021-23368 work?
CVE-2021-23368 works by exploiting a vulnerability in the way the postcss library parses a CSS string, causing a significant increase in processing time as the string grows.
What is the severity of CVE-2021-23368?
The severity of CVE-2021-23368 is medium, with a severity value of 5.3.
What software versions are affected by CVE-2021-23368?
The affected software versions include postcss versions up to and excluding 8.2.10, as well as node.js versions between 7.0.0 and 7.0.36 for the Postcss package.
How can I fix CVE-2021-23368?
To fix CVE-2021-23368, you should update the Postcss package to version 8.2.10 or later.