{"id":"CVE-2022-21222","aliases":["DEBIAN-CVE-2022-21222","DLA-3350-1","EUVD-2022-7138","GHSA-p28h-cc7q-c4fg","UBUNTU-CVE-2022-21222","USN-6065-1"],"status":"published","title":"Regular Expression Denial of Service (ReDoS)","description":"The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01904,"percentile":0.79889,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-400"],"published":"2022-09-30T05:05:11Z","modified":"2026-11-03T08:02:52Z","fixes":[{"ecosystem":"npm","package":"css-what","fixed_in":["2.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"node-css-what","fixed_in":["5.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-css-what","fixed_in":["5.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-css-what","fixed_in":["5.0.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-css-what","fixed_in":["2.1.0-1ubuntu0.16.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"node-css-what","fixed_in":["2.1.0-1+deb10u1build0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-css-what","fixed_in":["3.2.1-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"css-what","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"node-css-what","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-css-what","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-css-what","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"node-css-what","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-1+deb10u1"}]}],"versions":["2.1.0-1"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"css-what","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-css-what","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-1ubuntu0.16.04.1~esm1"}]}],"versions":["2.0.2-1","2.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-css-what","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-1+deb10u1build0.18.04.1"}]}],"versions":["2.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-css-what","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-1ubuntu0.1~esm1"}]}],"versions":["3.1.0-2","3.2.0-1","3.2.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-css-what","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-css-what","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-css-what","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-5","6.2.2-2","6.2.2-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-css-what","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-css-what","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-1ubuntu0.16.04.1~esm1"}]}],"versions":["2.0.2-1","2.1.0-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-css-what","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-1+deb10u1build0.18.04.1"}]}],"versions":["2.1.0-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-css-what","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-1ubuntu0.1~esm1"}]}],"versions":["3.1.0-2","3.2.0-1","3.2.1-1"],"bundled":2}],"products":[{"vendor":"css-what_project","product":"css-what"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-CSSWHAT-3035488","tags":["x_transferred","Exploit","Third Party Advisory","web","report"]},{"url":"https://github.com/fb55/css-what/blob/a38effd5a8f5506d75c7f8f13cbd8c76248a3860/index.js%23L12","tags":["x_transferred","Broken Link","Third Party Advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/03/msg00001.html","tags":["mailing-list","x_transferred","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21222","tags":["advisory"]},{"url":"https://github.com/fb55/css-what/commit/dc510929790da6617e7aa93a616498b22f6a6b72","tags":["web"]},{"url":"https://github.com/fb55/css-what/blob/a38effd5a8f5506d75c7f8f13cbd8c76248a3860/index.js#23L12","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p28h-cc7q-c4fg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21222.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-21222","tags":["advisory"]},{"url":"https://github.com/fb55/css-what","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-21222","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6065-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-33587","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-21222","title":"Regular Expression Denial of Service (ReDoS)","description":"The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.","status":"published","published":"2022-09-30T05:05:11.059Z","modified":"2025-05-20T16:04:07.202Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:34:29.478363Z"}],"euvd":[{"id":"EUVD-2022-7138","description":"The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.","status":"published","published":"2022-09-30T05:05:11Z","modified":"2025-05-20T16:04:07Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P","level":"medium"}],"updated_at":"2026-11-02T20:32:43.363755Z"}],"ghsa":[{"id":"GHSA-p28h-cc7q-c4fg","title":"css-what vulnerable to ReDoS due to use of insecure regular expression","description":"The package css-what before 2.1.3 is vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of insecure regular expression in the `re_attr` variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.","status":"published","published":"2022-10-01T00:00:24Z","modified":"2025-05-20T21:02:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-02T14:38:43.998596Z"}],"nvd":[{"id":"CVE-2022-21222","description":"The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.","status":"published","published":"2022-09-30T05:15:08.713Z","modified":"2026-06-17T04:25:46.883Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:07:29.026521Z"}],"osv":[{"id":"CVE-2022-21222","title":"Regular Expression Denial of Service (ReDoS)","description":"The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.","status":"published","published":"2022-09-30T05:05:11.059Z","modified":"2026-10-28T02:31:00.558770022Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P","level":"medium"}],"updated_at":"2026-11-02T15:44:23.655778Z"},{"id":"DEBIAN-CVE-2022-21222","description":"The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.","status":"published","published":"2022-09-30T05:15:08.713Z","modified":"2026-11-03T08:02:52.07972312Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"GHSA-p28h-cc7q-c4fg","title":"css-what vulnerable to ReDoS due to use of insecure regular expression","description":"The package css-what before 2.1.3 is vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of insecure regular expression in the `re_attr` variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.","status":"published","published":"2022-10-01T00:00:24Z","modified":"2025-05-20T21:02:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333","CWE-400"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"UBUNTU-CVE-2022-21222","description":"The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.","status":"published","published":"2022-09-30T05:15:00Z","modified":"2026-10-17T12:56:17.010119714Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:52.391598Z"},{"id":"DLA-3350-1","title":"node-css-what - security update","status":"published","published":"2023-03-03T00:00:00Z","modified":"2026-03-09T01:20:11.200562Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"USN-6065-1","title":"node-css-what vulnerabilities","description":"It was discovered that css-what incorrectly handled certain inputs. If a user\nor an automated system were tricked into opening a specially crafted input\nfile, a remote attacker could possibly use this issue to cause a denial of\nservice. (CVE-2021-33587, CVE-2022-21222)\n","status":"published","published":"2023-05-10T11:13:36Z","modified":"2026-06-25T13:32:03.162261736Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}