GitHub Advisoryadvisory · npm

GHSA-w8qv-6jwh-64r5 Regular Expression Denial of Service in browserslist

MEDIUM Published 2021-05-24 Modified 2021-05-20 Official page ↗
Aliases
CVE-2021-23364
Ecosystem
npm
Packages
browserslist
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-1333, CWE-400
Reviewed
2021-05-20

Affected packages

• npm browserslist: >= 4.0.0, < 4.16.5 → fixed in 4.16.5

Description

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Related

Alias · CVE (1)

  • CVE-2021-23364 The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of… vulnerability

Weakness · CWE (2)

  • CWE-1333 Inefficient Regular Expression Complexity weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References