---
title: "@adobe/css-tools security advisories"
description: "2 known security advisories for @adobe/css-tools, with the versions they affect and the version that fixes each."
url: https://inlinr.com/packages/@adobe/css-tools/security
lang: en
---

[Packages](https://inlinr.com/packages)

# @adobe/css-tools

4.5.0 · 21 May 2026 MIT 82.9M / week [Repository](https://github.com/adobe/css-tools) [Homepage](https://github.com/adobe/css-tools#readme) [npm](https://www.npmjs.com/package/@adobe/css-tools) [Atom feed](https://inlinr.com/packages/feed/@adobe/css-tools)

Your version 

## Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

| Line | Newest | Where it stands |
| ---- | ------ | --------------- |
|      | 4.5.0  | Safe from 4.3.2 |

- Moderate  
[@adobe/css-tools Improper Input Validation and Inefficient Regular Expression Complexity](https://inlinr.com/advisories/GHSA-prr3-c3m5-p7q2)GHSA-prr3-c3m5-p7q2 · 30 Nov 2023  
fixed in 4.3.2
- Moderate  
[@adobe/css-tools Regular Expression Denial of Service (ReDOS) while Parsing CSS](https://inlinr.com/advisories/GHSA-hpx4-r86g-5jrg)GHSA-hpx4-r86g-5jrg · 29 Aug 2023  
fixed in 4.3.1

### Quality and security signals

What [npm](https://www.npmjs.com/package/@adobe/css-tools) and [deps.dev](https://deps.dev/npm/%40adobe%2Fcss-tools) say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Reading releases, release notes and advisories…

Registry facts last checked 2 Nov 2026\. Releases and advisories last read 2 Nov 2026.