Skip to content
Sign in
5.3 Medium

CVE-2021-23382 The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via…

Description

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).

Affected products and versions

Product Affected versions Fixed in
postcss 8.2 earliest → < 8.2.13 8.2.13

Other CVEs of postcss

The 3 CVEs of postcss →
CVE-2026-9358 A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2 5.3 Medium CVE-2021-23368 The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during… 5.3 Medium
Track this CVE