CVE-2021-33587
Denial of service in css-what
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
- Record
CVE-2021-33587- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
- Record
CVE-2021-33587- Updated
- 2026-11-02
EUVDEUVD-2021-1380 No score
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
- Record
EUVD-2021-1380- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q8pj-2vqx-8ggc
Denial of service in css-what
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
- Record
GHSA-q8pj-2vqx-8ggc- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
- Record
CVE-2021-33587- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-33587
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
- Record
DEBIAN-CVE-2021-33587- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-q8pj-2vqx-8ggc
Denial of service in css-what
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
- Record
GHSA-q8pj-2vqx-8ggc- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-33587
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
- Record
UBUNTU-CVE-2021-33587- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1790414394 No score
TuxCare security update for css-what (1 CVE)
TuxCare rebuilt css-what to address 1 CVE. Fixed in 3.3.0-tuxcare.1.
- Record
CLSA-2026-1790414394- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2021-33587 No score
CVE-2021-33587 in @rootio/css-what - Patched by Root
Root has patched CVE-2021-33587 in the @rootio/css-what package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2021-33587- Updated
- 2026-11-02
OSVUSN-6065-1 No score
node-css-what vulnerabilities
It was discovered that css-what incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2021-33587, CVE-2022-21222)
- Record
USN-6065-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
css-whatnpm |
4.0.0 to 5.0.0 | 5.0.1 |
css-whatTuxCare:npm |
3.3.0-tuxcare.0 up to 3.3.0-tuxcare.1, plus listed versions 3.3.0 |
3.3.0-tuxcare.1 |
node-css-whatDebian:12 |
before 5.0.1-1 | 5.0.1-1 |
node-css-whatDebian:13 |
before 5.0.1-1 | 5.0.1-1 |
node-css-whatDebian:14 |
before 5.0.1-1 | 5.0.1-1 |
node-css-whatDebian:10 From an advisory covering 2 CVEs |
before 2.1.0-1+deb10u1, plus listed versions 2.1.0-1 |
2.1.0-1+deb10u1 |
css-whatnpm |
4.0.0 up to 5.0.1 | 5.0.1 |
@rootio/css-whatRoot:npm |
before 5.0.0-root.io.1 | 5.0.0-root.io.1 |
css-whatRoot:npm |
before 5.0.0-aikido.1 | 5.0.0-aikido.1 |
node-css-whatUbuntu:Pro:16.04:LTS |
before 2.1.0-1ubuntu0.16.04.1~esm1, plus listed versions 2.0.2-12.1.0-1 |
2.1.0-1ubuntu0.16.04.1~esm1 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
node-css-whatUbuntu:18.04:LTS |
before 2.1.0-1+deb10u1build0.18.04.1, plus listed versions 2.1.0-1 |
2.1.0-1+deb10u1build0.18.04.1 |
node-css-whatUbuntu:Pro:20.04:LTS |
before 3.2.1-1ubuntu0.1~esm1, plus listed versions 3.1.0-23.2.0-13.2.1-1 |
3.2.1-1ubuntu0.1~esm1 |
node-css-whatUbuntu:24.04:LTS |
All versions, plus listed versions 6.1.0-5 |
None known |
node-css-whatUbuntu:25.10 |
All versions, plus listed versions 6.1.0-5 |
None known |
node-css-whatUbuntu:26.10 |
All versions, plus listed versions 6.1.0-56.2.2-26.2.2-3 |
None known |
node-css-whatUbuntu:26.04:LTS |
All versions, plus listed versions 6.1.0-5 |
None known |
node-css-whatUbuntu:Pro:16.04:LTS From an advisory covering 2 CVEs |
before 2.1.0-1ubuntu0.16.04.1~esm1, plus listed versions 2.0.2-12.1.0-1 |
2.1.0-1ubuntu0.16.04.1~esm1 |
node-css-whatUbuntu:18.04:LTS From an advisory covering 2 CVEs |
before 2.1.0-1+deb10u1build0.18.04.1, plus listed versions 2.1.0-1 |
2.1.0-1+deb10u1build0.18.04.1 |
node-css-whatUbuntu:Pro:20.04:LTS From an advisory covering 2 CVEs |
before 3.2.1-1ubuntu0.1~esm1, plus listed versions 3.1.0-23.2.0-13.2.1-1 |
3.2.1-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-33587 is a high vulnerability (CVSS 7.5) in Css-what Project Css-what, published May 28, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.04%, the 81st percentile. Fixed in css-what 5.0.1.
References
github.com/fb55/css-what/releases/tag/v5.0.1
security.netapp.com/advisory/ntap-20210706-0007
lists.debian.org/debian-lts-announce/2023/03/msg00001.html
nvd.nist.gov/vuln/detail/CVE-2021-33587