{"id":"GHSA-9v62-24cr-58cx","aliases":[],"status":"published","title":"Denial of Service in node-sass","description":"Affected versions of `node-sass` are vulnerable to Denial of Service (DoS). Crafted objects passed to the `renderSync` function may trigger C++ assertions in `CustomImporterBridge::get_importer_entry` and `CustomImporterBridge::post_process_return_value` that crash the Node process. This may allow attackers to crash the system's running Node process and lead to Denial of Service.\n\n\n## Recommendation\n\nUpgrade to version 4.13.1 or later","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2020-09-11T21:12:39Z","modified":"2023-01-09T05:03:38Z","fixes":[{"ecosystem":"npm","package":"node-sass","fixed_in":["4.13.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"node-sass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"4.13.1"}]}]},{"source":"osv","ecosystem":"npm","package":"node-sass","ranges":[{"type":"SEMVER","events":[{"introduced":"3.3.0"},{"fixed":"4.13.1"}]}]}],"references":[{"url":"https://www.npmjs.com/advisories/961","tags":["web"]},{"url":"https://github.com/sass/node-sass/commit/338fd7a14d3b8bd374a382336df16f9c6792b884","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9v62-24cr-58cx"},{"url":"https://github.com/sass/node-sass","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-9v62-24cr-58cx","title":"Denial of Service in node-sass","description":"Affected versions of `node-sass` are vulnerable to Denial of Service (DoS). Crafted objects passed to the `renderSync` function may trigger C++ assertions in `CustomImporterBridge::get_importer_entry` and `CustomImporterBridge::post_process_return_value` that crash the Node process. This may allow attackers to crash the system's running Node process and lead to Denial of Service.\n\n\n## Recommendation\n\nUpgrade to version 4.13.1 or later","status":"published","published":"2020-09-11T21:12:39Z","modified":"2023-01-09T05:03:38Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:05.705235Z"}],"osv":[{"id":"GHSA-9v62-24cr-58cx","title":"Denial of Service in node-sass","description":"Affected versions of `node-sass` are vulnerable to Denial of Service (DoS). Crafted objects passed to the `renderSync` function may trigger C++ assertions in `CustomImporterBridge::get_importer_entry` and `CustomImporterBridge::post_process_return_value` that crash the Node process. This may allow attackers to crash the system's running Node process and lead to Denial of Service.\n\n\n## Recommendation\n\nUpgrade to version 4.13.1 or later","status":"published","published":"2020-09-11T21:12:39Z","modified":"2021-09-28T16:08:17Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}