Vulnerability record · CVE-2021-23382 · published 26 April 2021

CVE-2021-23382: Postcss inefficient regular expression (redos) vulnerability

Postcss · Postcss

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).

7.5 CVSS 3.1 High EPSS 2.6% · top 15.5% CWE-1333 · Inefficient regular expression (ReDoS)

7.5CVSS 3.1 base score, v2 5.0

2.6%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References, 4 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Postcss Postcss

References

Link	Tags
https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c1735956	PatchThird Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641	ExploitPatchThird Party Advisory
https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640	ExploitPatchThird Party Advisory
https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c1735956	PatchThird Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641	ExploitPatchThird Party Advisory
https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640	ExploitPatchThird Party Advisory

Track CVE-2021-23382 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2026-45623Postcss path traversal vulnerabilityPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.…EPSS 0.61%27 Jul 2026 6.3CVE-2026-69153Postcss path traversal vulnerabilityPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19,…EPSS 0.45%3 Aug 2026 5.3CVE-2023-44270Postcss injection vulnerabilityAn issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can pr…EPSS 0.82%29 Sep 2023 5.3CVE-2021-23368Postcss vulnerabilityThe package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.EPSS 3.5%12 Apr 2021

Source: NIST National Vulnerability Database (record CVE-2021-23382), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.