~ / search / GHSA-hwj9-h5mp-3pm3

GHSA-hwj9-h5mp-3pm3

Regular Expression Denial of Service in postcss

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-23368

Packages

EcosystemPackageAffectedFixed in
npm postcss >= 7.0.0, < 7.0.36 7.0.36
npm postcss >= 8.0.0, < 8.2.10 8.2.10

Details

As written in the advisory (Markdown source, shown as plain text).

The npm package `postcss` from 7.0.0 and before versions 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.

References

External links from the advisory. They lead to third-party sites.