CVE-2022-31103: lettersanitizer - Denial of Service Vulnerability
Summary
CVE-2022-31103: Improper handling of CSS at-rules in lettersanitizer. Affects lettersanitizer versions < 1.0.2. Fixed in 1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
lettersanitizer is an npm package that provides a sanitization utility for letters generated by the react-letter library. It is used to process CSS at-rules in letters and ensure their safe rendering. The package is widely relied upon by applications utilizing react-letter for generating dynamic letters.
However, versions of lettersanitizer prior to 1.0.2 are susceptible to a denial of service vulnerability when handling a CSS at-rule called @keyframes. This vulnerability can be exploited to cause a denial of service, potentially impacting the availability of affected applications.
Vulnerability Detail
The vulnerability in lettersanitizer arises from improper handling of the CSS at-rule @keyframes. By crafting a malicious letter containing a specially crafted @keyframes at-rule, an attacker can trigger a denial of service condition in applications that utilize lettersanitizer. This can lead to unresponsive or unavailable services, impacting the availability of the affected application.
The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 1.0.9 as of 22 Oct 2026
npm install lettersanitizer@1.0.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.2
This is the first release that contains the fix.
npm install lettersanitizer@1.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to lettersanitizer version 1.0.2 or later to mitigate the risk.
Conclusion
The lettersanitizer package, used for sanitizing letters in react-letter, is vulnerable to a denial of service issue when processing a CSS at-rule called @keyframes. This vulnerability can be mitigated by upgrading to lettersanitizer version 1.0.2 or later. It is crucial to promptly apply the patch to ensure the continued secure processing of CSS at-rules in letters. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lettersanitizer →
FAQ
lettersanitizer is an npm package used for sanitizing letters generated by the react-letter library. It ensures the safe rendering of CSS at-rules in letters.
The vulnerability allows an attacker to trigger a denial of service condition in applications that utilize lettersanitizer. This can lead to unresponsive or unavailable services, impacting the availability of the affected application.
To fix this vulnerability, it is recommended to upgrade lettersanitizer to version 1.0.2 or later.
There is no known workaround for this vulnerability. Upgrading to the patched version is the only solution.
The CVSS score assigned to this vulnerability is 7.5, indicating a high severity level.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
