← Vulnerability feed

Vulnerability record · CVE-2021-23368 · published 12 April 2021

CVE-2021-23368: Postcss vulnerability

Postcss · Postcss

The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.

5.3 CVSS 3.1 Medium EPSS 3.5% · top 11.2%
5.3CVSS 3.1 base score, v2 5.0
3.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
20References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/postcss/postcss/commit/8682b1e4e328432ba692bed52326e84439cec9e4 PatchThird Party Advisory
https://github.com/postcss/postcss/commit/b6f3e4d5a8d7504d553267f80384373af3a3dec5 PatchThird Party Advisory
https://lists.apache.org/thread.html/r00158f5d770d75d0655c5eef1bdbc6150531606c8f8bcb778f0627be%40%3Cdev.myfaces.apache.o
https://lists.apache.org/thread.html/r16e295b4f02d81b79981237d602cb0b9e59709bafaa73ac98be7cef1%40%3Cdev.myfaces.apache.o
https://lists.apache.org/thread.html/r49afb49b38748897211b1f89c3a64dc27f9049474322b05715695aab%40%3Cdev.myfaces.apache.o
https://lists.apache.org/thread.html/r5acd89f3827ad9a9cad6d24ed93e377f7114867cd98cfba616c6e013%40%3Ccommits.myfaces.apac
https://lists.apache.org/thread.html/r8def971a66cf3e375178fbee752e1b04a812a047cc478ad292007e33%40%3Cdev.myfaces.apache.o
https://lists.apache.org/thread.html/rad5af2044afb51668b1008b389ac815a28ecea9eb75ae2cab5a00ebb%40%3Ccommits.myfaces.apac
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1244795 ExploitPatchThird Party Advisory
https://snyk.io/vuln/SNYK-JS-POSTCSS-1090595 ExploitPatchThird Party Advisory
https://github.com/postcss/postcss/commit/8682b1e4e328432ba692bed52326e84439cec9e4 PatchThird Party Advisory
https://github.com/postcss/postcss/commit/b6f3e4d5a8d7504d553267f80384373af3a3dec5 PatchThird Party Advisory
https://lists.apache.org/thread.html/r00158f5d770d75d0655c5eef1bdbc6150531606c8f8bcb778f0627be%40%3Cdev.myfaces.apache.o
https://lists.apache.org/thread.html/r16e295b4f02d81b79981237d602cb0b9e59709bafaa73ac98be7cef1%40%3Cdev.myfaces.apache.o
https://lists.apache.org/thread.html/r49afb49b38748897211b1f89c3a64dc27f9049474322b05715695aab%40%3Cdev.myfaces.apache.o
https://lists.apache.org/thread.html/r5acd89f3827ad9a9cad6d24ed93e377f7114867cd98cfba616c6e013%40%3Ccommits.myfaces.apac
https://lists.apache.org/thread.html/r8def971a66cf3e375178fbee752e1b04a812a047cc478ad292007e33%40%3Cdev.myfaces.apache.o
https://lists.apache.org/thread.html/rad5af2044afb51668b1008b389ac815a28ecea9eb75ae2cab5a00ebb%40%3Ccommits.myfaces.apac
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1244795 ExploitPatchThird Party Advisory
https://snyk.io/vuln/SNYK-JS-POSTCSS-1090595 ExploitPatchThird Party Advisory

Track CVE-2021-23368 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2026-45623Postcss path traversal vulnerabilityPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.…EPSS 0.61%7.5CVE-2021-23382Postcss inefficient regular expression (redos) vulnerabilityThe package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/p…EPSS 2.6%6.3CVE-2026-69153Postcss path traversal vulnerabilityPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19,…EPSS 0.45%5.3CVE-2023-44270Postcss injection vulnerabilityAn issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can pr…EPSS 0.82%

Source: NIST National Vulnerability Database (record CVE-2021-23368), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.