{"id":"CVE-2021-23368","aliases":["CLSA-2026-1776299672","CLSA-2026-1779065198","CLSA-2026-1779324473","CLSA-2026-1779670117","CLSA-2026-1792164471","DEBIAN-CVE-2021-23368","EUVD-2021-1108","GHSA-hwj9-h5mp-3pm3","ROOT-APP-NPM-CVE-2021-23368","UBUNTU-CVE-2021-23368"],"status":"published","title":"Regular Expression Denial of Service (ReDoS)","description":"The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.03511,"percentile":0.89353,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2021-04-12T13:50:14Z","modified":"2026-10-23T18:03:37Z","fixes":[{"ecosystem":"npm","package":"postcss","fixed_in":["7.0.36","8.2.10"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"node-postcss","fixed_in":["8.2.1+~cs5.3.23-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-postcss","fixed_in":["8.2.1+~cs5.3.23-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-postcss","fixed_in":["8.2.1+~cs5.3.23-6"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"postcss","fixed_in":["7.0.36-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/postcss","fixed_in":["7.0.36-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.36"}]}]},{"source":"ghsa","ecosystem":"npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.2.10"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.14-tuxcare.0"},{"fixed":"7.0.14-tuxcare.1"}]}],"versions":["7.0.14"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.21-tuxcare.0"},{"fixed":"7.0.21-tuxcare.1"}]}],"versions":["7.0.21"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.32-tuxcare.0"},{"fixed":"7.0.32-tuxcare.1"}]}],"versions":["7.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.17-tuxcare.0"},{"fixed":"7.0.17-tuxcare.1"}]}],"versions":["7.0.17"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.9-tuxcare.0"},{"fixed":"8.2.9-tuxcare.1"}]}],"versions":["8.2.9"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.1+~cs5.3.23-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.1+~cs5.3.23-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.1+~cs5.3.23-6"}]}]},{"source":"osv","ecosystem":"npm","package":"postcss","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.0.36"}]}]},{"source":"osv","ecosystem":"npm","package":"postcss","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.2.10"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.36-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.36-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.2.1+~cs5.3.23-8","8.4.5+~cs7.1.51-2","8.4.6+~cs7.3.21-1"]}],"products":[{"vendor":"postcss","product":"postcss"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-POSTCSS-1090595","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1244795","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/postcss/postcss/commit/b6f3e4d5a8d7504d553267f80384373af3a3dec5","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/postcss/postcss/commit/8682b1e4e328432ba692bed52326e84439cec9e4","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.apache.org/thread.html/r16e295b4f02d81b79981237d602cb0b9e59709bafaa73ac98be7cef1%40%3Cdev.myfaces.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r8def971a66cf3e375178fbee752e1b04a812a047cc478ad292007e33%40%3Cdev.myfaces.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r00158f5d770d75d0655c5eef1bdbc6150531606c8f8bcb778f0627be%40%3Cdev.myfaces.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r5acd89f3827ad9a9cad6d24ed93e377f7114867cd98cfba616c6e013%40%3Ccommits.myfaces.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rad5af2044afb51668b1008b389ac815a28ecea9eb75ae2cab5a00ebb%40%3Ccommits.myfaces.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r49afb49b38748897211b1f89c3a64dc27f9049474322b05715695aab%40%3Cdev.myfaces.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23368","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r00158f5d770d75d0655c5eef1bdbc6150531606c8f8bcb778f0627be@%3Cdev.myfaces.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r16e295b4f02d81b79981237d602cb0b9e59709bafaa73ac98be7cef1@%3Cdev.myfaces.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r49afb49b38748897211b1f89c3a64dc27f9049474322b05715695aab@%3Cdev.myfaces.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r5acd89f3827ad9a9cad6d24ed93e377f7114867cd98cfba616c6e013@%3Ccommits.myfaces.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r8def971a66cf3e375178fbee752e1b04a812a047cc478ad292007e33@%3Cdev.myfaces.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rad5af2044afb51668b1008b389ac815a28ecea9eb75ae2cab5a00ebb@%3Ccommits.myfaces.apache.org%3E","tags":["web"]},{"url":"https://github.com/postcss/postcss/commit/54cbf3c4847eb0fb1501b9d2337465439e849734","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hwj9-h5mp-3pm3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-23368","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-23368","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23368","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-23368","title":"Regular Expression Denial of Service (ReDoS)","description":"The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.","status":"published","published":"2021-04-12T13:50:14.764Z","modified":"2024-09-16T17:27:47.659Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2021-1108","description":"The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.","status":"published","published":"2021-04-12T13:50:14Z","modified":"2024-09-16T17:27:47Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:55:41.925187Z"}],"ghsa":[{"id":"GHSA-hwj9-h5mp-3pm3","title":"Regular Expression Denial of Service in postcss","description":"The npm package `postcss` from 7.0.0 and before versions 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.","status":"published","published":"2021-05-10T15:29:24Z","modified":"2023-02-01T05:05:31Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:34.917834Z"}],"nvd":[{"id":"CVE-2021-23368","description":"The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.","status":"published","published":"2021-04-12T14:15:14.257Z","modified":"2026-06-17T03:38:37.997Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:51.610648Z"}],"osv":[{"id":"CVE-2021-23368","description":"The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.","status":"published","published":"2021-04-12T14:15:14.257Z","modified":"2026-10-20T10:54:31.938273593Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"DEBIAN-CVE-2021-23368","description":"The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.","status":"published","published":"2021-04-12T14:15:14.257Z","modified":"2026-10-23T18:03:37.005852175Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-hwj9-h5mp-3pm3","title":"Regular Expression Denial of Service in postcss","description":"The npm package `postcss` from 7.0.0 and before versions 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.","status":"published","published":"2021-05-10T15:29:24Z","modified":"2025-01-14T08:57:30.487716Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:49.621585Z"},{"id":"UBUNTU-CVE-2021-23368","description":"The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.","status":"published","published":"2021-04-12T14:15:00Z","modified":"2025-09-08T16:46:59Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"CLSA-2026-1776299672","title":"TuxCare security update for postcss (3 CVEs)","description":"TuxCare rebuilt postcss to address 3 CVEs. Fixed in 7.0.14-tuxcare.1.","status":"published","published":"2026-08-04T14:52:26Z","modified":"2026-10-15T09:47:49.890461269Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1779065198","title":"TuxCare security update for postcss (4 CVEs)","description":"TuxCare rebuilt postcss to address 4 CVEs. Fixed in 7.0.21-tuxcare.1.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-10-15T09:45:28.666234919Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779324473","title":"TuxCare security update for postcss (4 CVEs)","description":"TuxCare rebuilt postcss to address 4 CVEs. Fixed in 7.0.32-tuxcare.1.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:48:03.725144745Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779670117","title":"TuxCare security update for postcss (4 CVEs)","description":"TuxCare rebuilt postcss to address 4 CVEs. Fixed in 7.0.17-tuxcare.1.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:47:50.219691591Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1792164471","title":"TuxCare security update for postcss (3 CVEs)","description":"TuxCare rebuilt postcss to address 3 CVEs. Fixed in 8.2.9-tuxcare.1.","status":"published","published":"2026-10-16T15:27:51Z","modified":"2026-10-16T16:30:46.820295121Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"ROOT-APP-NPM-CVE-2021-23368","title":"CVE-2021-23368 in postcss - Patched by Root","description":"Root has patched CVE-2021-23368 in the postcss package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-28T07:39:33Z","modified":"2026-08-28T08:45:04.292733598Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}