Regular expression denial of service (ReDoS) in postcss
Priority LOW 30CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 2 fixed, 5 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.
Why it matters now
EPSS 0.03511 89th percentileScored 2026-11-07
Fix Partial postcss: 8.2.10postcss (npm): 7.0.36, 8.2.10Red Hat: 2 advisoriesRed Hat: 2 fixed, 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | postcss | 7.0.0 and later; before 8.2.10 | 8.2.10 | Patch available | CNA |
| — | postcss (npm) | 7.0.0 to before 7.0.36 | 7.0.36 | Patch available | GHSA-hwj9-h5mp-3pm3 |
| — | postcss (npm) | 8.0.0 to before 8.2.10 | 8.2.10 | Patch available | GHSA-hwj9-h5mp-3pm3 |
- postcss Vendor— Affected 7.0.0 and later; before 8.2.10 Fixed in 8.2.10 Patch available CNA
- postcss (npm) Vendor— Affected 7.0.0 to before 7.0.36 Fixed in 7.0.36 Patch available GHSA-hwj9-h5mp-3pm3
- postcss (npm) Vendor— Affected 8.0.0 to before 8.2.10 Fixed in 8.2.10 Patch available GHSA-hwj9-h5mp-3pm3
Remediation
- Fix · CNA postcss Fixed in 8.2.10
- Fix · GHSA-hwj9-h5mp-3pm3 postcss (npm) Fixed in 7.0.36 Advisory →
- Fix · GHSA-hwj9-h5mp-3pm3 postcss (npm) Fixed in 8.2.10 Advisory →
Red Hat 2 advisories
- RHSA-2021:3917 Released 2021-10-19 · Red Hat rating ImportantRed Hat Quay v3.6.0 security, bug fix and enhancement update
- Quay v3 quay/quay-rhel8
- RHSA-2021:2438 Released 2021-07-27 · Red Hat rating ModerateOpenShift Container Platform 4.8.2 bug fix and security update
- Red Hat OpenShift Container Platform 4.8 openshift4/driver-toolkit-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat Virtualization 4 | Affected | No fix planned: Will not fix |
| Quay v3 | Fixed | RHSA-2021:3917 |
| Red Hat OpenShift Container Platform 4.8 | Fixed | RHSA-2021:2438 |
Not affected: 4 products
- Quay v3
- Red Hat Ansible Automation Platform 1.2
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4.8
Timeline
- 2026-10-02 Threatist record created from CVE-2021-23368
- 2026-10-03 Alias added: GHSA-hwj9-h5mp-3pm3
References
Patch 2
Other 13
- [myfaces-dev] 20210421 [GitHub] [myfaces-tobago] henningn opened a new pull request #774: build(postcss): update dependency to fix CVE-2021-23368
- [myfaces-dev] 20210421 [GitHub] [myfaces-tobago] henningn merged pull request #774: build(postcss): update dependency to fix CVE-2021-23368
- [myfaces-dev] 20210421 [GitHub] [myfaces-tobago] lofwyr14 opened a new pull request #775: Updating lib, to avoid CVE problem CVE-2021-23368 with postcss
- [myfaces-commits] 20210421 [myfaces-tobago] branch master updated: Updating lib, to avoid CVE problem CVE-2021-23368 with postcss
- [myfaces-commits] 20210421 [myfaces-tobago] branch master updated: build(postcss): update dependency to fix CVE-2021-23368
- [myfaces-dev] 20210421 [GitHub] [myfaces-tobago] lofwyr14 merged pull request #775: Updating lib, to avoid CVE problem CVE-2021-23368 with postcss
- https://github.com/postcss/postcss/commit/54cbf3c4847eb0fb1501b9d2337465439e849734
- https://lists.apache.org/thread.html/r00158f5d770d75d0655c5eef1bdbc6150531606c8f8bcb778f0627be@%3Cdev.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/r16e295b4f02d81b79981237d602cb0b9e59709bafaa73ac98be7cef1@%3Cdev.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/r49afb49b38748897211b1f89c3a64dc27f9049474322b05715695aab@%3Cdev.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/r5acd89f3827ad9a9cad6d24ed93e377f7114867cd98cfba616c6e013@%3Ccommits.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/r8def971a66cf3e375178fbee752e1b04a812a047cc478ad292007e33@%3Cdev.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/rad5af2044afb51668b1008b389ac815a28ecea9eb75ae2cab5a00ebb@%3Ccommits.myfaces.apache.org%3E
More Postcss vulnerabilities
- TI-2026-33367 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments CVSS 3.1CRITICAL 9.1
- TI-2026-48533 Information disclosure in postcss CVSS 4.0MEDIUM 6.3
- TI-2021-06075 Regular expression denial of service (ReDoS) in postcss CVSS 3.1HIGH 7.5
- TI-2023-23794 An issue was discovered in PostCSS before 8.4.31. CVSS 3.1MEDIUM 5.3
Sources
- CVE-2021-23368 · CVE Program
- CVE-2021-23368 · NVD
- FIRST EPSS
- GHSA-hwj9-h5mp-3pm3 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-23368 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences