CVE-2021-23382: Regular Expression Denial of Service (ReDoS)
A regular expression denial of service (ReDoS) vulnerability was found in the npm library `postcss` when using getAnnotationURL() or loadAnnotation() options in lib/previous-map.js. An attacker can use this vulnerability to potentially craft a malicious CSS to process resulting in a denial of service.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-23382?
CVE-2021-23382 refers to a vulnerability in the package postcss before version 8.2.13 that allows Regular Expression Denial of Service (ReDoS) attacks via getAnnotationURL() and loadAnnotation() in lib/previous-map.js.
How does CVE-2021-23382 affect postcss?
CVE-2021-23382 affects postcss versions before 7.0.36 or between 8.0.0 and 8.2.13.
What is the severity level of CVE-2021-23382?
CVE-2021-23382 has a severity level of 7.5 (high).
How can I fix CVE-2021-23382?
To fix CVE-2021-23382, update postcss package to version 7.0.36 or higher, or between 8.2.13 and the latest version.
Where can I find more information about CVE-2021-23382?
You can find more information about CVE-2021-23382 at the following references: - https://www.cve.org/CVERecord?id=CVE-2021-23382 - https://nvd.nist.gov/vuln/detail/CVE-2021-23382 - https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640 - https://bugzilla.redhat.com/show_bug.cgi?id=1954150 - https://access.redhat.com/errata/RHSA-2021:3016