CVE-2021-23382: Regular Expression Denial of Service in postcss
Summary
CVE-2021-23382: Regular Expression Denial of Service in postcss. Affects postcss across 2 version ranges.
< 7.0.36
>= 8.0.0, < 8.2.13
Fixed in 7.0.36 or 8.2.13, depending on the release line you run. How to fix ↓
Also tracked for
- node-postcss · Debian:11
The same CVE-2021-23382 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostCSS is a popular tool for transforming CSS with JavaScript. It is widely used in web development to process CSS files and apply various transformations. The vulnerability, identified as CVE-2021-23382, affects versions of the postcss package prior to 7.0.36 or between 8.0.0 and 8.2.13. This vulnerability exposes the package to Regular Expression Denial of Service (ReDoS) attacks. The specific vulnerable functions are getAnnotationURL() and loadAnnotation() in the lib/previous-map.js file. The vulnerability arises from the presence of a sub-pattern, /*\s* sourceMappingURL=(.*), which can lead to excessive backtracking and cause a denial of service.
Vulnerability Detail
The Regular Expression Denial of Service (ReDoS) vulnerability in postcss can be exploited by an attacker to cause a denial of service by sending specially crafted input. The vulnerable regex pattern, /*\s* sourceMappingURL=(.*), can lead to excessive backtracking when processing certain input, causing the application to become unresponsive or crash. This can be exploited by an attacker to disrupt the availability of the affected system. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.3.
How To Fix
Latest published version: 8.5.31 as of 22 Oct 2026
npm install postcss@8.5.31Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 7.0.367.0.36npm install postcss@7.0.36 -
>= 8.0.0, < 8.2.138.2.13npm install postcss@8.2.13
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the postcss package is not immediately feasible, a temporary workaround is to sanitize user input and restrict the use of the vulnerable regex pattern. By validating and sanitizing input that may trigger the vulnerable regex, the risk of exploitation can be reduced. Additionally, implementing rate limiting or request throttling mechanisms can help mitigate the impact of potential ReDoS attacks.
Conclusion
The Regular Expression Denial of Service (ReDoS) vulnerability in postcss can be mitigated by updating the package to the recommended versions. Regularly updating dependencies and implementing input validation can further reduce the risk of exploitation. For more information and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for postcss →
FAQ
PostCSS is a tool for transforming CSS with JavaScript. It is widely used in web development to process CSS files and apply various transformations.
Regular Expression Denial of Service (ReDoS) is a type of vulnerability that can be exploited by an attacker to cause a denial of service by sending specially crafted input that triggers excessive backtracking in regular expressions.
The vulnerability in postcss can lead to a denial of service, causing the affected system to become unresponsive or crash. This can result in service disruption and impact the availability of the application or system.
To mitigate the risk of this vulnerability, it is recommended to update the postcss package to the latest version available. Regularly updating all dependencies and implementing input validation and sanitization can also help reduce the risk of exploitation.
A temporary workaround for this vulnerability is to sanitize user input and restrict the use of the vulnerable regex pattern. Implementing rate limiting or request throttling mechanisms can also help mitigate the impact of potential ReDoS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for postcss.
