Regular Expression Denial of Service (ReDoS) in node-postcss - CVE-2021-23382
Summary
CVE-2021-23382: The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. Affects node-postcss across 2 version ranges.
< 2b1d04c867995e55124e0a165b7c6622c1735956
< 8.2.1+~cs5.3.23-7
Fixed in 8.2.1+~cs5.3.23-7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-postcss is a widely used tool in the web development ecosystem that allows developers to transform CSS with JavaScript plugins. It is known for its flexibility and extensibility, enabling a variety of functionalities such as autoprefixing, minification, and linting. However, prior to version 8.2.13, node-postcss contained vulnerabilities that could be exploited through its regular expressions, specifically in the handling of source maps.
Vulnerability Detail
The vulnerability identified as CVE-2021-23382 is a Regular Expression Denial of Service (ReDoS) that affects the node-postcss package versions before 8.2.13. This vulnerability arises from the use of inefficient regular expressions in the functions getAnnotationURL() and loadAnnotation() within the lib/previous-map.js file. The regex patterns can lead to excessive backtracking, causing the application to hang or crash when processing specially crafted input. This can result in service downtime and degraded performance, impacting users and applications relying on node-postcss for CSS processing.
How To Fix
Minimum fixed version
8.2.1+~cs5.3.23-7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-postcssTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to sanitize any user-provided CSS before processing it with node-postcss. This can help mitigate the risk of triggering the vulnerable regex patterns.
Conclusion
CVE-2021-23382 is a significant vulnerability in the node-postcss package that can lead to Denial of Service attacks through inefficient regular expressions. Users are strongly advised to upgrade to version 8.2.13 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for node-postcss →
FAQ
CVE-2021-23382 is a vulnerability in the node-postcss package that allows for Regular Expression Denial of Service (ReDoS), potentially causing application downtime.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploiting this vulnerability can lead to service outages and degraded performance, affecting users and applications that rely on node-postcss.
Yes, implementing input validation to sanitize user-provided CSS can help reduce the risk of triggering the vulnerable regex patterns.
The CVSS score for CVE-2021-23382 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-postcss.
