CVE-2022-25758: Regular expression denial of service in scss-tokenizer
Summary
CVE-2022-25758: Regular expression denial of service in scss-tokenizer. Affects scss-tokenizer versions < 0.4.3. Fixed in 0.4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The scss-tokenizer package is an npm package used for tokenizing SCSS (Sassy CSS) code. It provides functions to parse and tokenize SCSS input. The package is widely used in web development projects that involve SCSS preprocessing. However, versions prior to 0.4.3 of scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regex in the loadAnnotation() function.
Vulnerability Detail
The vulnerability in scss-tokenizer allows an attacker to perform a Regular Expression Denial of Service (ReDoS) attack. This type of attack exploits the inefficient matching behavior of certain regular expressions, causing the application to consume excessive CPU resources and potentially leading to a denial of service. By sending specially crafted input, an attacker can cause the loadAnnotation() function to enter a state of exponential time complexity, resulting in a significant performance degradation or even a complete system freeze. This vulnerability has a CVSS score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How To Fix
Latest published version: 0.4.3 as of 23 Oct 2026
npm install scss-tokenizer@0.4.3The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version (0.4.3) of the scss-tokenizer package to mitigate the risk.
Conclusion
The scss-tokenizer package prior to version 0.4.3 is vulnerable to Regular Expression Denial of Service (ReDoS). It is crucial to update to version 0.4.3 or later to fix this vulnerability and mitigate the risk of a denial of service attack. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for scss-tokenizer →
FAQ
scss-tokenizer is an npm package used for tokenizing SCSS code. It provides functions to parse and tokenize SCSS input.
Regular Expression Denial of Service (ReDoS) is a type of attack that exploits the inefficient matching behavior of certain regular expressions. By sending specially crafted input, an attacker can cause the application to consume excessive CPU resources and potentially lead to a denial of service.
This vulnerability can lead to a denial of service, causing significant performance degradation or even a complete system freeze.
To fix this vulnerability, it is recommended to upgrade to version 0.4.3 or later of the scss-tokenizer package.
There is no known workaround for this vulnerability. It is essential to update to the fixed version (0.4.3) of the scss-tokenizer package to mitigate the risk.
