css-what vulnerable to ReDoS due to use of insecure regular expression

Description

The package css-what before 2.1.3 is vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.

Recommendation

Update the css-what package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.1.3
• Patched version(s): 2.1.3

References

• GHSA-p28h-cc7q-c4fg
• security.snyk.io
• lists.debian.org
• CVE-2022-21222
• CWE-1333
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• angular vulnerable to regular expression denial of service (ReDoS) - CVE-2022-25844
• Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing - CVE-2024-1899
• @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking - CVE-2025-25285
• jquery-validation Regular Expression Denial of Service due to arbitrary input to url2 method - CVE-2022-31147

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

css-what