CVE-2021-23382

PoC ×2—

CVSS 3.1

7.5 high

EPSS

3%p84

Published

Apr 26, 2021 (Apr 26, 2021)

Modified

Jun 17, 2026

Description

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).

Vendors: postcss
Products: postcss
Weakness: CWE-1333
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (2.5%)

In the news0 stories

No ingested article mentions this CVE yet.