# CVE-2021-23368: postcss Regular Expression Denial of Service

Source: https://junglewise.ai/threats/cve-2021-23368-postcss-regular-expression-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-05-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-23368 · Severity: low · CVSS 3.1 · Published 2021-05-10

postcss is a popular JavaScript tool for parsing and transforming CSS code, widely used in web development. A regular expression flaw in its source map parsing can cause the application to hang or consume excessive CPU resources when processing maliciously crafted input, leading to denial of service attacks against applications using the library.

Technologies: [postcss (npm)](https://junglewise.ai/threats/technologies/postcss). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-23368 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-23368 being exploited in the wild.

**How severe is CVE-2021-23368?** Low severity, with a CVSS score of 3.1, published 10 May 2021.

**Which products and versions are affected?** postcss (npm) SEMVER:introduced=7.0.0,fixed=7.0.36.

**Is there a fix for CVE-2021-23368?** Yes. postcss (npm): upgrade to 7.0.36 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-23368 attacked?** It is attacked over the network.

**Am I affected by CVE-2021-23368?** Check whether you run postcss (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- postcss (npm): upgrade to 7.0.36 or later

  ```sh
  npm install postcss@7.0.36
  ```


## Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in postcss versions 7.0.0 through 7.0.35 and 8.0.0 through 8.2.9, specifically in the source map parsing component (previous-map.es6). The vulnerability arises from a poorly constructed regular expression that exhibits catastrophic backtracking behavior when processing input with certain patterns. An attacker can supply a maliciously crafted CSS file with a specially crafted source map to trigger excessive regex engine resource consumption, causing the application to hang or become unresponsive. The attack requires network reachability to deliver the malicious CSS/source map to an application using postcss, with no authentication required. Patches are available in versions 7.0.36 and 8.2.10 and later.

## Affected products

- postcss postcss 7.0.0 through 7.0.35, 8.0.0 through 8.2.9

## Identifiers

- CVE-2021-23368
- GHSA-hwj9-h5mp-3pm3

## Timeline

- 2021-04-12: disclosed
- 2021-05-10: advisory
- 2021-05-07: patched

## References

- [https://github.com/postcss/postcss/commit/54cbf3c4847eb0fb1501b9d2337465439e849734](https://github.com/postcss/postcss/commit/54cbf3c4847eb0fb1501b9d2337465439e849734)

## Related threats

- [PostCSS path traversal in source map auto-loading](https://junglewise.ai/threats/cve-2026-73646-postcss-path-traversal-in-source-map-auto-loading)
- [PostCSS path traversal in sourceMappingURL parsing](https://junglewise.ai/threats/cve-2026-69153-postcss-path-traversal-in-sourcemappingurl-parsing)
- [PostCSS arbitrary file read via sourceMappingURL path traversal](https://junglewise.ai/threats/cve-2026-45623-postcss-arbitrary-file-read-via-sourcemappingurl-path-traversal)
- [PostCSS has XSS via Unescaped </style> in its CSS Stringify Output](https://junglewise.ai/threats/cve-2026-41305-postcss-has-xss-via-unescaped-style-in-its-css-stringify-output)
- [PostCSS line return parsing error in CSS tokenization](https://junglewise.ai/threats/cve-2023-44270-postcss-line-return-parsing-error-in-css-tokenization)