Executive brief
taro-css-to-react-native is an npm library that converts CSS to React Native styling. A regular expression denial-of-service (ReDoS) vulnerability allows attackers to craft malicious input that causes excessive CPU consumption, potentially freezing the application or denying service to legitimate users.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS, CWE-1333) caused by inefficient regular expression complexity in taro-css-to-react-native. The flaw exists in the file taro/packages/css-to-react-native/src/index.js and can be triggered remotely when the library processes specially crafted CSS input strings. An attacker with ability to supply input to the CSS parsing function can cause excessive backtracking in the vulnerable regex, resulting in high CPU consumption and potential application freezes. The issue was fixed in version 4.1.2 via patch c2e321a8b6fc873427c466c69f41ed0b5e8814bf.
Affected products
- taro taro-css-to-react-native before 4.1.2
Timeline
- 2025-06-09: disclosed
- 2025-06-09: patched: Fixed in version 4.1.2