# CVE-2021-23382: PostCSS regular expression denial of service in previous-map

Source: https://junglewise.ai/threats/cve-2021-23382-postcss-regular-expression-denial-of-service-in-previous-map  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-01-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-23382 · Severity: low · CVSS 3.1 · Published 2022-01-07

PostCSS is a widely-used JavaScript tool for transforming CSS stylesheets using plugins. A flaw in PostCSS's source map parsing allows an attacker to supply malicious CSS containing carefully-crafted sourceMappingURL comments that cause the regex engine to consume excessive CPU, freezing the application. Any service that parses untrusted CSS files—such as web builders, CSS processors, or build pipelines—could be rendered unavailable.

Technologies: [postcss (npm)](https://junglewise.ai/threats/technologies/postcss). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-23382 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-23382 being exploited in the wild.

**How severe is CVE-2021-23382?** Low severity, with a CVSS score of 3.1, published 7 January 2022.

**Which products and versions are affected?** postcss (npm) SEMVER:introduced=8.0.0,fixed=8.2.13.

**Is there a fix for CVE-2021-23382?** Yes. postcss (npm): upgrade to 8.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-23382 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-23382?** Check whether you run postcss (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- postcss (npm): upgrade to 8.2.13 or later

  ```sh
  npm install postcss@8.2.13
  ```


## Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in the getAnnotationURL() and loadAnnotation() functions within lib/previous-map.js. The vulnerable regex pattern `/\*\s*#\s*sourceMappingURL=(.*)` exhibits catastrophic backtracking when processing malicious input—specifically, repeated "/*# sourceMappingURL=" sequences without a closing comment. An attacker can craft a CSS file with nested sourceMappingURL markers that cause the regex engine to exponentially increase backtracking attempts (e.g., 14 repeated markers trigger over 65,000 regex steps), consuming all available CPU and blocking legitimate processing. The attack requires only network access to a service that calls postcss.parse() on untrusted input; no authentication or user interaction is needed. Patches are available in versions 7.0.36 and 8.2.13 or later.

## Affected products

- PostCSS postcss before 7.0.36 or 8.0.0 to 8.2.13

## Identifiers

- CVE-2021-23382
- GHSA-566m-qj78-rww5

## Timeline

- 2021-04-26: disclosed
- 2021-06-11: patched: version 7.0.36 released
- 2021-11-04: patched: version 8.2.13 released (inferred)

## References

- [https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c1735956](https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c1735956)
- [https://github.com/postcss/postcss/releases/tag/7.0.36](https://github.com/postcss/postcss/releases/tag/7.0.36)
- [https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641](https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641)
- [https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640](https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640)

## Related threats

- [PostCSS path traversal in source map auto-loading](https://junglewise.ai/threats/cve-2026-73646-postcss-path-traversal-in-source-map-auto-loading)
- [PostCSS path traversal in sourceMappingURL parsing](https://junglewise.ai/threats/cve-2026-69153-postcss-path-traversal-in-sourcemappingurl-parsing)
- [PostCSS arbitrary file read via sourceMappingURL path traversal](https://junglewise.ai/threats/cve-2026-45623-postcss-arbitrary-file-read-via-sourcemappingurl-path-traversal)
- [PostCSS has XSS via Unescaped </style> in its CSS Stringify Output](https://junglewise.ai/threats/cve-2026-41305-postcss-has-xss-via-unescaped-style-in-its-css-stringify-output)
- [PostCSS line return parsing error in CSS tokenization](https://junglewise.ai/threats/cve-2023-44270-postcss-line-return-parsing-error-in-css-tokenization)