Packages / postcss / Security

ModerateVulnerabilityGHSA-hwj9-h5mp-3pm3CVE-2021-23368Published 10 May 2021

Regular Expression Denial of Service in postcss

Affected releases · postcss

  • 8.x8.0.0 – 8.2.9Fixed in 8.2.10
  • 7.x7.0.0 – 7.0.35Fixed in 7.0.36

On 8.x, the newest line:

npm install postcss@8.2.10
8.x

  1. Affected

    8.0.0 – 8.2.9

    35 releases

  2. Fixed

    8.2.10 – 8.5.31

    100 releases, latest

7.x

  1. Affected

    7.0.0 – 7.0.35

    36 releases

  2. Fixed

    7.0.36 – 7.0.39

    4 releases

296 stable releases of postcss, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for postcss. It is read in your browser and sent nowhere.

What happens

The npm package postcss from 7.0.0 and before versions 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.