Is CVE-2021-23382 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-23382 being exploited in the wild.

How severe is CVE-2021-23382?

Low severity, with a CVSS score of 3.1, published 7 January 2022.

Which products and versions are affected?

postcss (npm) SEMVER:introduced=8.0.0,fixed=8.2.13.

Is there a fix for CVE-2021-23382?

Yes. postcss (npm): upgrade to 8.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-23382 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-23382?

Check whether you run postcss (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-23382: PostCSS regular expression denial of service in previous-map

CVE-2021-23382 · Severity: low · CVSS 3.1 · Published 2022-01-07

PostCSS is a widely-used JavaScript tool for transforming CSS stylesheets using plugins. A flaw in PostCSS's source map parsing allows an attacker to supply malicious CSS containing carefully-crafted sourceMappingURL comments that cause the regex engine to consume excessive CPU, freezing the application. Any service that parses untrusted CSS files—such as web builders, CSS processors, or build pipelines—could be rendered unavailable.

Technologies: postcss (npm). Vendors: npm.

Quick answers

Is CVE-2021-23382 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-23382 being exploited in the wild.
How severe is CVE-2021-23382?: Low severity, with a CVSS score of 3.1, published 7 January 2022.
Which products and versions are affected?: postcss (npm) SEMVER:introduced=8.0.0,fixed=8.2.13.
Is there a fix for CVE-2021-23382?: Yes. postcss (npm): upgrade to 8.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-23382 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-23382?: Check whether you run postcss (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

postcss (npm): upgrade to 8.2.13 or later
```
npm install postcss@8.2.13
```

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in the getAnnotationURL() and loadAnnotation() functions within lib/previous-map.js. The vulnerable regex pattern `/\*\s*#\s*sourceMappingURL=(.*)` exhibits catastrophic backtracking when processing malicious input—specifically, repeated "/*# sourceMappingURL=" sequences without a closing comment. An attacker can craft a CSS file with nested sourceMappingURL markers that cause the regex engine to exponentially increase backtracking attempts (e.g., 14 repeated markers trigger over 65,000 regex steps), consuming all available CPU and blocking legitimate processing. The attack requires only network access to a service that calls postcss.parse() on untrusted input; no authentication or user interaction is needed. Patches are available in versions 7.0.36 and 8.2.13 or later.

Affected products

PostCSS postcss before 7.0.36 or 8.0.0 to 8.2.13

Identifiers

CVE-2021-23382
GHSA-566m-qj78-rww5

Timeline

2021-04-26: disclosed
2021-06-11: patched: version 7.0.36 released
2021-11-04: patched: version 8.2.13 released (inferred)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.