Packages / @adobe/css-tools / Security

ModerateVulnerabilityGHSA-hpx4-r86g-5jrgCVE-2023-26364Published 29 Aug 2023

@adobe/css-tools Regular Expression Denial of Service (ReDOS) while Parsing CSS

Your version

Affected releases · @adobe/css-tools

  • 4.x4.0.0 – 4.3.0Fixed in 4.3.1

On 4.x, the newest line:

npm install @adobe/css-tools@4.3.1
Every release on a timeline

  1. Affected

    4.0.0 – 4.3.0

    6 releases

  2. Fixed

    4.3.1 – 4.5.0

    9 releases, latest

15 stable releases of @adobe/css-tools, oldest to newest.

What happens

Impact

@adobe/css-tools version 4.3.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.

Patches

The issue has been resolved in 4.3.1.

Workarounds

None

References

N/A