Unrated
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/pr...
CVE-2021-23382
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2021-23382 node-postcss Fixed in: 8.2.1+~cs5.3.23-7
Original description The description as published by the source.
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- patch github.com
- patch snyk.io
- patch snyk.io