GitHub Advisoryadvisory · npm

GHSA-q8pj-2vqx-8ggc Denial of service in css-what

HIGH Published 2021-06-07 Modified 2021-12-02 Official page ↗
Aliases
CVE-2021-33587
Ecosystem
npm
Packages
css-what
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2021-06-01

Affected packages

• npm css-what: >= 4.0.0, < 5.0.1 → fixed in 5.0.1

Description

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.

Related

Alias · CVE (1)

  • CVE-2021-33587 The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References