High severityNVD Advisory· Published Sep 30, 2022· Updated May 20, 2025
Regular Expression Denial of Service (ReDoS)
CVE-2022-21222
Description
The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
css-whatnpm | < 2.1.3 | 2.1.3 |
Affected products
2- css-what/css-whatdescription
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-p28h-cc7q-c4fgghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-21222ghsaADVISORY
- github.com/fb55/css-what/blob/a38effd5a8f5506d75c7f8f13cbd8c76248a3860/index.jsghsaWEB
- github.com/fb55/css-what/blob/a38effd5a8f5506d75c7f8f13cbd8c76248a3860/index.js%23L12ghsaWEB
- github.com/fb55/css-what/commit/dc510929790da6617e7aa93a616498b22f6a6b72ghsaWEB
- lists.debian.org/debian-lts-announce/2023/03/msg00001.htmlghsamailing-listWEB
- security.snyk.io/vuln/SNYK-JS-CSSWHAT-3035488ghsaWEB
News mentions
0No linked articles in our index yet.