VYPR
← All advisories
Moderate severityNVD Advisory· Published Apr 12, 2021· Updated Sep 16, 2024

Regular Expression Denial of Service (ReDoS)

CVE-2021-23368

Description

PostCSS before 8.2.10 is vulnerable to ReDoS during source map parsing, allowing attackers to cause denial of service via crafted input.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

PostCSS before 8.2.10 is vulnerable to ReDoS during source map parsing, allowing attackers to cause denial of service via crafted input.

Vulnerability

The postcss package versions from 7.0.0 and before 8.2.10 contain a Regular Expression Denial of Service (ReDoS) vulnerability in the source map parsing functionality [1]. The issue is caused by unsafe regular expressions used during the processing of source map annotations, specifically in the getAnnotationURL() function and related parsing logic [2][3]. This affects all versions starting from 7.0.0 up to, but not including, 8.2.10.

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted source map string that causes the regular expression engine to exhibit catastrophic backtracking [4]. The attacker does not require authentication; exploitation is possible by sending a malicious CSS file or source map to a system that parses it using a vulnerable version of PostCSS. The crafted input can be delivered via user uploads, CSS imports, or any attack vector that allows an attacker to control the source map content processed by PostCSS.

Impact

Successful exploitation leads to a denial of service (DoS) condition. The affected regular expression evaluation consumes an excessive amount of CPU time, causing the Node.js process to become unresponsive or extremely slow [1][4]. This can degrade or completely deny service to legitimate users of the application using PostCSS. No data confidentiality or integrity impact is expected; the attack solely targets availability.

Mitigation

The vulnerability is fixed in PostCSS version 8.2.10 [1]. Users are strongly advised to upgrade to version 8.2.10 or later. The fix was implemented in commits 8682b1e and b6f3e4d, which hardened the regular expressions used in source map parsing [2][3]. No workarounds are documented; upgrading to the patched version is the recommended mitigation.

References
  1. NVD - CVE-2021-23368
  2. Fix unsafe regexp · postcss/postcss@8682b1e
  3. Fix unsafe regexp in getAnnotationURL() too · postcss/postcss@b6f3e4d
  4. Snyk Vulnerability Database | Snyk

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
postcssnpm
>= 7.0.0, < 7.0.367.0.36
postcssnpm
>= 8.0.0, < 8.2.108.2.10

Affected products

2
  • postcss/postcssdescription
  • ghsa-coords
    pkg:npm/postcss
    Range: >= 7.0.0, < 7.0.36

Patches

3
54cbf3c4847e

Backport ReDoS vulnerabilities from PostCSS 8

https://github.com/postcss/postcssAndrey SitnikJun 11, 2021via ghsa
commit
1 file changed · +4 −2
  • lib/previous-map.es6+4 −2 modified
    @@ -73,12 +73,14 @@ class PreviousMap {
 
   getAnnotationURL (sourceMapString) {
     return sourceMapString
-      .match(/\/\*\s*# sourceMappingURL=(.*)\s*\*\//)[1]
+      .match(/\/\*\s*# sourceMappingURL=((?:(?!sourceMappingURL=).)*)\*\//)[1]
       .trim()
   }
 
   loadAnnotation (css) {
-    let annotations = css.match(/\/\*\s*# sourceMappingURL=(.*)\s*\*\//mg)
+    let annotations = css.match(
+      /\/\*\s*# sourceMappingURL=(?:(?!sourceMappingURL=).)*\*\//gm
+    )
 
     if (annotations && annotations.length > 0) {
       // Locate the last sourceMappingURL to avoid picking up
b6f3e4d5a8d7

Fix unsafe regexp in getAnnotationURL() too

https://github.com/postcss/postcssAndrey SitnikApr 11, 2021via ghsa
commit
1 file changed · +1 −3
  • lib/previous-map.js+1 −3 modified
    @@ -48,9 +48,7 @@ class PreviousMap {
   }
 
   getAnnotationURL(sourceMapString) {
-    return sourceMapString
-      .match(/\/\*\s*# sourceMappingURL=(.*)\s*\*\//)[1]
-      .trim()
+    return sourceMapString.match(/\/\*\s*# sourceMappingURL=(.*)\*\//)[1].trim()
   }
 
   loadAnnotation(css) {
8682b1e4e328

Fix unsafe regexp

https://github.com/postcss/postcssAndrey SitnikApr 8, 2021via ghsa
commit
1 file changed · +1 −1
  • lib/previous-map.js+1 −1 modified
    @@ -54,7 +54,7 @@ class PreviousMap {
   }
 
   loadAnnotation(css) {
-    let annotations = css.match(/\/\*\s*# sourceMappingURL=.*\s*\*\//gm)
+    let annotations = css.match(/\/\*\s*# sourceMappingURL=.*\*\//gm)
 
     if (annotations && annotations.length > 0) {
       // Locate the last sourceMappingURL to avoid picking up

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

19

News mentions

0

No linked articles in our index yet.