Description
The package css-what before 2.1.3 is vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.
Recommendation
Update the css-what package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.1.3
- Patched version(s): 2.1.3
References
Could your website be exposed too?
SmartScanner can check your website for css-what vulnerable to ReDoS due to use of insecure regular expression and gives you actionable findings to investigate.
Start a free scanRelated Issues
- angular vulnerable to regular expression denial of service (ReDoS) - CVE-2022-25844
- Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing - CVE-2024-1899
- @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking - CVE-2025-25285
- jquery-validation Regular Expression Denial of Service due to arbitrary input to url2 method - CVE-2022-31147
You might also like:
See something that needs correcting? Let us knowUpdated May 20, 2025