Medium severity5.3NVD Advisory· Published Sep 30, 2022· Updated Jun 17, 2026
CVE-2022-21222
CVE-2022-21222
Description
The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
css-whatnpm | < 2.1.3 | 2.1.3 |
Affected products
3- css-what/css-whatdescription
Patches
Vulnerability mechanics
References
7- security.snyk.io/vuln/SNYK-JS-CSSWHAT-3035488nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-p28h-cc7q-c4fgghsaADVISORY
- github.com/fb55/css-what/blob/a38effd5a8f5506d75c7f8f13cbd8c76248a3860/index.js%23L12nvdBroken LinkThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2022-21222ghsaADVISORY
- github.com/fb55/css-what/blob/a38effd5a8f5506d75c7f8f13cbd8c76248a3860/index.jsghsaWEB
- github.com/fb55/css-what/commit/dc510929790da6617e7aa93a616498b22f6a6b72ghsaWEB
- lists.debian.org/debian-lts-announce/2023/03/msg00001.htmlnvdWEB
News mentions
0No linked articles in our index yet.