---
title: "GHSA-hpx4-r86g-5jrg: @adobe/css-tools Regular Expression Denial of Service (ReDOS) while Parsing CSS"
description: "Moderate severity. @adobe/css-tools Regular Expression Denial of Service (ReDOS) while Parsing CSS. Affects @adobe/css-tools; fixed in 4.3.1."
url: https://inlinr.com/advisories/GHSA-hpx4-r86g-5jrg
lang: en
---

[Packages](https://inlinr.com/packages) / [@adobe/css-tools](https://inlinr.com/packages/@adobe/css-tools) / [Security](https://inlinr.com/packages/@adobe/css-tools/security)

Moderate Vulnerability GHSA-hpx4-r86g-5jrg CVE-2023-26364 Published 29 Aug 2023

# @adobe/css-tools Regular Expression Denial of Service (ReDOS) while Parsing CSS

Your version 

Affected releases · [@adobe/css-tools](https://inlinr.com/packages/@adobe/css-tools)

- 4.x 4.0.0 – 4.3.0 Fixed in 4.3.1

On 4.x, the newest line:

```
npm install @adobe/css-tools@4.3.1
```

Every release on a timeline

1. Affected

4.0.0 – 4.3.0  
6 releases
2. Fixed

4.3.1 – 4.5.0  
9 releases, latest

15 stable releases of @adobe/css-tools, oldest to newest.

## What happens

Impact

@adobe/css-tools version 4.3.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.

Patches

The issue has been resolved in 4.3.1.

Workarounds

None

References

N/A

## How it is exploited

Exploitable over the network, with a low-privilege account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: low

CVSS:3.1/​AV:N/​AC:L/​PR:L/​UI:N/​S:C/​C:N/​I:N/​A:L

## References

- [Reference](https://github.com/adobe/css-tools/security/advisories/GHSA-hpx4-r86g-5jrg "https://github.com/adobe/css-tools/security/advisories/GHSA-hpx4-r86g-5jrg")  
github.com/adobe/css-tools/security/advisories/…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-26364 "https://nvd.nist.gov/vuln/detail/CVE-2023-26364")  
nvd.nist.gov/vuln/detail/CVE-2023-26364
- [Fix commit](https://github.com/adobe/css-tools/commit/2b09a25d1dbdbb16fe80065e4c9beb5623ee5793 "https://github.com/adobe/css-tools/commit/2b09a25d1dbdbb16fe80065e4c9beb5623ee5793")  
2b09a25
- [Package](https://github.com/adobe/css-tools "https://github.com/adobe/css-tools")  
github.com/adobe/css-tools