Description
The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
Recommendation
Update the browserslist package to the latest compatible version. Followings are version details:
- Affected version(s): >= 4.0.0, < 4.16.5
- Patched version(s): 4.16.5
References
Could your website be exposed too?
SmartScanner can check your website for Regular Expression Denial of Service in browserslist and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Regular Expression Denial of Service (ReDoS) in ua-parser-js - CVE-2021-27292
- Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-paste-from-office - CVE-2021-21391
- semver-regex Regular Expression Denial of Service (ReDOS) - CVE-2021-3795
- html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) - html-parse-stringify - CVE-2021-23346
You might also like:
See something that needs correcting? Let us knowUpdated August 17, 2023