Denial of service in css-what

Description

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.

Recommendation

Update the css-what package to the latest compatible version. Followings are version details:

• Affected version(s): >= 4.0.0, <= 5.0.0
• Patched version(s): 5.0.1

References

• GHSA-q8pj-2vqx-8ggc
• security.netapp.com
• lists.debian.org
• CVE-2021-33587
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service (ReDOS) - color-string - CVE-2021-29060
• Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-engine - CVE-2021-21391
• Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-font - CVE-2021-21391
• Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-image - CVE-2021-21391

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

css-what