The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: snyk

Published: 2021-04-26T15:30:26.301297Z

Updated: 2024-09-16T23:26:53.744Z

Reserved: 2021-01-08T00:00:00

Link: CVE-2021-23382

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2021-04-26T16:15:07.330

Modified: 2023-08-08T14:22:24.967

Link: CVE-2021-23382

cve-icon Redhat

Severity : Moderate

Publid Date: 2021-04-26T00:00:00Z

Links: CVE-2021-23382 - Bugzilla