Regular Expression Denial of Service in clean-css
Summary
GHSA-wxhq-pm8v-cw75: Regular Expression Denial of Service in clean-css. Affects clean-css versions < 4.1.11. Fixed in 4.1.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The clean-css package is an open-source library used for minifying CSS files. It is commonly used in web development projects to reduce the size of CSS files and improve website performance. The package utilizes regular expressions to parse and manipulate CSS code. However, versions prior to 4.1.11 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack.
Vulnerability Detail
The vulnerability in clean-css arises from the potential for catastrophic backtracking during regular expression matching. If untrusted input is provided, the regular expressions used by the package can enter into an inefficient matching state, causing excessive processing time and leading to a Denial of Service (DoS) condition. This can render the application unresponsive and impact its availability.
How To Fix
Minimum fixed version
4.1.11
This is the first release that contains the fix.
npm install clean-css@4.1.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The clean-css package prior to version 4.1.11 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. Upgrading to version 4.1.11 or higher is recommended to mitigate this vulnerability. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for clean-css →
FAQ
clean-css is an open-source library used for minifying CSS files. It helps reduce the size of CSS code and improve website performance.
ReDoS is a type of vulnerability that occurs when a regular expression pattern is susceptible to excessive backtracking. This can lead to a significant increase in processing time and potentially cause a Denial of Service (DoS) condition.
If exploited, this vulnerability can cause the clean-css package to become unresponsive, leading to a Denial of Service (DoS) situation. This can impact the availability of the application and disrupt its normal operation.
To fix this vulnerability, it is recommended to upgrade to version 4.1.11 or higher of the clean-css package. This version includes the necessary fixes to address the Regular Expression Denial of Service (ReDoS) vulnerability.
No specific workaround is mentioned for this vulnerability. It is advised to upgrade to the fixed version of the clean-css package.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
